Executive brief
A vulnerability in MongoDB Server allows an authenticated user to crash the database service. MongoDB is a widely used database for storing and managing application data; an exploit of this flaw would result in a denial-of-service, disrupting business operations and application availability. The issue occurs when specific server-side JavaScript functions are used in an unintended sequence.
Technical details
This vulnerability is classified as a Use-After-Free (CWE-416) within the MongoDB server-side JavaScript engine. An attacker with basic authentication can trigger the flaw by first invoking the internal '$_internalJsEmit' function or a specific 'mapreduce' map function, followed by executing other JavaScript-dependent operations such as '$where', '$function', or 'mapreduce' reduce stages. This sequence leads to a memory corruption that crashes the 'mongod' process. The attack requires network access and valid user credentials, and it is mitigated by the high complexity of the specific execution sequence required. Patches are available in versions 7.0.34, 8.0.23, 8.2.9, and 8.3.2.
Affected products
- MongoDB MongoDB Server 7.0 versions prior to 7.0.34, 8.0 versions prior to 8.0.23, 8.2 versions prior to 8.2.9, 8.3 versions prior to 8.3.2
Timeline
- 2026-03-13: other: Issue reported internally in MongoDB Jira
- 2026-05-12: patched: Issue resolved in source code
- 2026-05-13: disclosed: CVE published and NVD entry created