Executive brief
A vulnerability in MongoDB's server-side JavaScript engine could allow an authorized user to access sensitive information from the server's internal memory. This occurs when the database incorrectly handles specific data objects, potentially leaking private system data to the user. This issue affects organizations that have enabled server-side JavaScript execution in their MongoDB deployments.
Technical details
A type confusion vulnerability (CWE-843) exists in MongoDB's server-side JavaScript engine due to improper handling of DBPointer objects during BSON serialization. An authenticated attacker with the ability to execute server-side JavaScript can trigger this flaw to leak internal process memory contents back to the client. The vulnerability is reachable over the network but requires low-level privileges (PR:L). The issue has been addressed in MongoDB Server versions 7.0.39, 8.0.28, 8.2.12, 8.3.7, and 9.0.0-rc1.
Affected products
- MongoDB MongoDB Server 7.0 < 7.0.39, 8.0 < 8.0.28, 8.2.0 < 8.2.12, 8.3.0 < 8.3.7
Timeline
- 2026-07-22: disclosed
- 2026-07-22: advisory