CyberSecBulletin
CVE-2026-126837NVD status: Awaiting Analysis

Node.js Driver: Incorrect Behavior Order: Validate Before Canonicalize

Published Updated By the CyberSecBulletin desk

CVE-2026-126837 is a high-severity incorrect behavior order: validate before canonicalize vulnerability in Node.js Driver from MongoDB, with a CVSS 3.1 base score of 7.4 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists version 7.8.0 as the first without the flaw, so updating Node.js Driver to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.21% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Node.js Driver to 7.8.0 or a later version.
  2. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
MongoDBNode.js Driver3.3.3 up to, but not including, 7.8.07.8.0

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
HighSuccess depends on conditions outside the attacker's control.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
NoneAvailability is not affected.

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. Scored by CNA (mongodb.com).

Scoring systemScoreSeverityScored by
CVSS 4.09.1CriticalCNA (mongodb.com)
CVSS 3.17.4HighCNA (mongodb.com)

Official description

A validation flaw in the DNS SRV host discovery of the MongoDB Node.js driver may cause the driver to connect to a host outside the expected domain. For a mongodb+srv:// connection string, the driver checks each host name in the DNS SRV response against the domain of the connection string. The driver then builds the connection address from the original name, in which certain characters end the host name early. An unauthenticated party who can forge or change the DNS SRV response may redirect the connection to a host of their choice. TLS does not prevent this, because the driver verifies the server certificate against the redirected host name. This may result in unintended disclosure of application data and authentication credentials, and in altered query results. Applications that use mongodb:// connection strings are not affected.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Incorrect Behavior Order: Validate Before Canonicalize

The product validates input before it is canonicalized.

How developers prevent this class of flaw

  • Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.

More Incorrect Behavior Order: Validate Before Canonicalize vulnerabilities (CWE-180)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in Node.js Driver

All Node.js Driver vulnerabilities

Recent Incorrect Behavior Order: Validate Before Canonicalize vulnerabilities

Spotted an error? Tell us.