Executive brief
MongoDB Server is a widely used database for storing and managing application data. A vulnerability has been identified where an authorized user with basic read access can crash the database service by running a specifically crafted data query. This could lead to a service outage, impacting application availability and business operations.
Technical details
A use-after-free vulnerability exists in MongoDB Server's $function aggregation operator due to improper memory management in the server-side JavaScript execution environment. The root cause is a failure to call advanceGeneration() in the evaluate_javascript.cpp component, which allows unowned BSON objects from previous document processing cycles to be retained in JavaScript global variables. An attacker with read privileges can exploit this by submitting a crafted aggregation pipeline that accesses freed stack memory, leading to a denial-of-service (mongod process crash) or potential heap content leakage. The issue is fixed in versions 7.0.39, 8.0.28, 8.2.12, 8.3.7, and 9.0.0-rc0.
Affected products
- MongoDB MongoDB Server 7.0 < 7.0.39, 8.0 < 8.0.28, 8.2.0 < 8.2.12, 8.3.0 < 8.3.7
Timeline
- 2026-06-08: disclosed: Issue reported via MongoDB Jira
- 2026-06-09: patched: Issue resolved in development branch
- 2026-07-22: advisory: CVE published and NVD record created