# MongoDB Node.js driver exception handling denial of service

Source: https://junglewise.ai/threats/mongodb-node-js-driver-exception-handling-denial-of-service-4ceb0cf4  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: info · Published 2020-09-03

The MongoDB Node.js driver (npm package) fails to properly handle exceptions when working with invalid collection names on non-existent databases, causing application crashes. An attacker or misconfigured client can trigger this flaw to disrupt service availability by forcing the application to terminate unexpectedly.

Technologies: [MongoDB Node.js Driver](https://junglewise.ai/threats/technologies/node-js-driver). Vendors: [MongoDB](https://junglewise.ai/threats/vendors/mongodb).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 3 September 2020.

**Which products and versions are affected?** MongoDB Node.js Driver before 3.1.13.

**Is there a fix for This vulnerability?** A patch was published on 2020-09-03: Fix available in version 3.1.13 and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network or with local access, in a software library.

**Am I affected?** Check whether you run MongoDB Node.js Driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an unhandled exception flaw in the MongoDB Node.js driver (npm package). When a collection name is invalid and the database does not exist, the driver fails to catch an exception, leading to an application crash. The attack vector is local or network-based depending on how the driver is exposed; an attacker or malicious client can send requests with invalid collection names to trigger the denial of service. No authentication bypass or data access is possible; the impact is limited to application availability. The flaw affects all versions prior to 3.1.13, which introduced proper exception handling. A patch is available by upgrading to version 3.1.13 or later.

## Affected products

- MongoDB Node.js Driver before 3.1.13

## Timeline

- 2020-09-03: disclosed
- 2020-09-03: patched: Fix available in version 3.1.13 and later

## References

- [https://www.npmjs.com/advisories/1203](https://www.npmjs.com/advisories/1203)

## Related threats

- [MongoDB Node.js driver DNS SRV validation bypass](https://junglewise.ai/threats/cve-2026-126837-a-validation-flaw-in-the-dns-srv-host-discovery-of-the-mongodb)
- [MongoDB Node.js driver OIDC bearer token disclosure to unallowed hosts](https://junglewise.ai/threats/cve-2026-126835-the-mongodb-node-js-driver-does-not-consistently-enforce-its)
- [MongoDB Node.js driver connection pool data leakage](https://junglewise.ai/threats/cve-2026-119179-a-flaw-in-the-connection-management-layer-of-the-mongodb-node-js)
- [MongoDB Driver authentication data exposure in event publishing](https://junglewise.ai/threats/cve-2021-32050-mongodb-driver-authentication-data-exposure-in-event-publishing)