Executive brief
MongoDB Server contains a flaw that allows an authenticated user—even one without any assigned database privileges—to crash the database server by submitting a specially crafted aggregation command. This could cause unplanned service outages and disrupt applications that depend on the database.
Technical details
The vulnerability exists in MongoDB's aggregation command handler, where the $documents operator improperly accepts internal parameters ($_resumeAfter and $_startAt) that should only be used on forward collection scans. An authenticated user can supply these parameters in an aggregation pipeline to trigger an unexpected server process termination. The attack requires network access to the MongoDB instance and valid authentication credentials (though the authenticated user need not have specific collection or database privileges). The root cause is a missing validation check that enforces the documented constraint that $_resumeAfter and $_startAt are valid only on collection scans, not on synthetic data sources like $documents. MongoDB has released patches in versions 8.2.13, 8.3.8, 9.0.0-rc2, and 9.1.0-rc0.
Affected products
- MongoDB Server versions before 8.2.13, 8.3.8, 9.0.0-rc2, and 9.1.0-rc0
Timeline
- 2026-08-11: disclosed
- 2026-08-11: patched: Fixed in MongoDB Server 8.2.13, 8.3.8, 9.0.0-rc2, and 9.1.0-rc0