MongoDB vulnerabilities
383 CVEs and advisories name MongoDB as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-120954Silent element-count truncation via 32-bit bit-length overflow in packed-bit vector views
- CVE-2026-120955MongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Application on Malformed GridFS Metadata
- CVE-2026-120956remote abort and memory disclosure from a malformed cursor.ns
- CVE-2026-120684MongoDB C Driver GridFS gap lets a shared writer recover a protected client's password
- CVE-2026-120678MongoDB C Driver leaks the decompressed reply buffer when an OP_COMPRESSED reply fails to parse (denial of service)
- CVE-2026-120673Rust Driver 3.9.1 exports CSFLE plaintext in `db.query.text` before encrypting the command
- CVE-2026-119674mongorestore may restore encoded collection names into an unintended collection
- CVE-2026-119673mongofiles may write outside the working directory through a symlink
- CVE-2026-119672mongofiles may disclose GridFS content to standard output through a stored filename
- CVE-2026-119675mongorestore may bypass collection guards through a system.buckets prefix
- CVE-2026-119179MongoDB Node.js driver: Connection pool desynchronization after operation timeout can expose other user's data
- CVE-2026-116641The DB Tools trust certificates issued by recoverable eMudhra intermediate CAs
- CVE-2026-118581NoSQL injection via mismatched BSON size prefix in raw document splice to the wire protocol
- CVE-2026-118510Laravel MongoDB `whereDoesntHave` misses deny records for numeric string IDs
- CVE-2026-115930MongoDB Shell (mongosh) bundled with Node.js trusts certificates issued by recoverable eMudhra intermediate CAs
- CVE-2026-115929MongoDB Compass trusts certificates issued by recoverable eMudhra intermediate CAs
- CVE-2026-114655KMS request injection via unsanitized key vault and provider values in libmongocrypt
- CVE-2026-114654BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards
- CVE-2026-114653Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builder
- CVE-2026-114652Update operator injection via single-element list rewriting in the update builder
- CVE-2026-114651Cross-document data leak via malformed BSON array parsing in reused thread buffer
- CVE-2026-114650Plaintext exposure of encrypted fields via ANSI code-page corruption of database name
- CVE-2026-114649Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache
- CVE-2026-114648NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary keys
- CVE-2026-114647NoSQL operator injection via unvalidated replacement document in findOneAndReplace
- CVE-2026-114646NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire
- CVE-2026-114645Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message wrapping
- CVE-2026-114644Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization
- CVE-2026-114643Duplicate geometry fields via unvalidated GeoJSON extra members
- CVE-2026-113870Improper Encoding of Server-Supplied JavaScript Values in MongoDB Compass BSON Parsing