MongoDB vulnerabilities
We track 134 vulnerabilities in MongoDB products across 40 products. 134 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on November 13, 2026.
Latest MongoDB vulnerabilities
- 7.5 High severity
C# Driver: Deserialization of Untrusted Data
A type allow-list bypass in the BSON serialization library of the MongoDB C# Driver allows a type-restriction check to be circumvented when polymorphic data is deserialized into loosely typed members. An unauthorized party who can supply or plant BSON/JSON dat
- 7.0 High severity
A local user with an ordinary account on the same host can place a file in a shared temporary…
A local user with an ordinary account on the same host can place a file in a shared temporary location that the JDBC driver's native library loading routine will accept and load without verifying its origin. Loading the driver class in a Java application may t
- 7.4 High severity
Node.js Driver: Incorrect Behavior Order: Validate Before Canonicalize
A validation flaw in the DNS SRV host discovery of the MongoDB Node.js driver may cause the driver to connect to a host outside the expected domain. For a mongodb+srv:// connection string, the driver checks each host name in the DNS SRV response against the do
- 7.5 High severity
MongoDB Server: Allocation of Resources Without Limits or Throttling
A replica-set database server node does not limit or reclaim internal wait records created while handling a client-supplied read option that names a point in time the node will never reach. A party with network access and no credentials can cause these records
- 8.8 High severity
MongoDB Server: Use After Free
A use-after-free in the time-series collection component of MongoDB Server can occur when the server validates a time-series bucket document during a write. The condition can be caused by an authenticated user with privileges to write bucket documents directly
- 7.1 High severity
MongoDB Server: Use After Free
A use-after-free weakness in MongoDB Server's server-side JavaScript support for aggregation may allow a stale reference to previously freed process memory to be read and returned. An authenticated user with minimal or no assigned roles can trigger this condit
- 10.0 Critical severity
MongoDB Server: Use After Free
A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up. The condition can be caused by requests that do not require authentication, and may result in the server terminating unexpect
- 8.4 High severity
MongoDB Server: Incorrect Authorization
An incorrect authorization check in the MongoDB Server authorization subsystem may allow an unauthenticated party with local host access to obtain administrative privileges on a database server that has authorization enabled. This may result in unintended acce
- 7.2 High severity
MongoDB Server: Execution with Unnecessary Privileges
An improper privilege management issue in the sharding subsystem of MongoDB Server may allow a user holding certain shard-level administrative privileges to cause persisted internal coordination state to be reprocessed with elevated internal authority. Because
- 7.4 High severity
MongoDB Server: Improper Certificate Validation
An issue exists in MongoDB's macOS TLS client implementation where certificate chain-of-trust validation is bypassed for outbound connections to IPv6-addressed peers. When a MongoDB process using the Apple SecureTransport TLS backend connects to an IPv6 target
- 7.5 High severity
MongoDB Server: Missing Release of Resource after Effective Lifetime
A flaw exists in the server-side SSPI Kerberos authentication handler on Windows Enterprise builds of MongoDB. When processing certain authentication requests, the server fails to properly release an underlying system resource due to an internal tracking error
- 7.1 High severity
MongoDB Server: Use After Free
A use-after-free issue exists in MongoDB’s SBE (Slot-Based Execution) implementation of a window function accumulator used by certain $setWindowFields aggregation pipelines. Under specific conditions, the accumulator can retain a dangling pointer to memory tha
- 7.1 High severity
Atlas SQL ODBC Driver: Out-of-bounds Write
An out-of-bounds write in the MongoDB Atlas SQL ODBC Driver may be triggered when a value of a particular database type is retrieved into a fixed-width client-side target. The driver produces a textual form of the value that is longer than the fixed target the
- 7.1 High severity
C Driver: Reachable Assertion
The MongoDB C Driver does not validate the type or format of a namespace field returned by the server in a query response. A MongoDB endpoint that a client application connects to, without needing any credentials, can return a malformed value in that field. Th
- 7.5 High severity
C Driver: NULL Pointer Dereference
The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain error conditions during file retrieval. This can cause the process to terminate when stream operations continue. A user who can influence file
- 7.5 High severity
C Driver: Missing Release of Memory after Effective Lifetime
A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to hold on to memory that is never released. An unauthenticated party that controls the database endpoint a client application connects to may caus
- 8.6 High severity
Database Tools: Use of Incorrectly-Resolved Name or Reference
MongoDB Database Tools mongorestore inconsistently handles the system.buckets. prefix when validating collection names in an untrusted dump. A specially crafted collection name can bypass special-collection guards and operator namespace filters, causing a rest
- 7.0 High severity
Node.js Driver: Sensitive Information in Resource Not Removed Before Reuse
A flaw in the connection management layer of the MongoDB Node.js driver can leave a pooled network connection in the pool for reuse while data from an earlier operation is still outstanding on it. In applications that enable an optional client-side operation t
- 8.8 High severity
Laravel MongoDB: Access of Resource Using Incompatible Type
A type-handling flaw in the relationship query building of this MongoDB integration library can cause a check for the absence of a related record to be compiled with an identifier of the wrong data type. In an application that relies on such a check to decide
- 7.6 High severity
C# Driver: Improper Neutralization of Special Elements in Data Query Logic
The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them into the field paths it sends to the server. An application user whose input reaches these
- 8.8 High severity
Compass: Improper Encoding or Escaping of Output
MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployment containing a specially crafted view and opens that view for editing, the values can c
- 7.5 High severity
PHP Driver: Uncontrolled Recursion
An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary document data to the decoder to exhaust the process stack. This may cause the PHP process using the driver
- 8.2 High severity
PHP Driver: Incorrect Conversion between Numeric Types
The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The resulting he
- 7.4 High severity
C Driver: Integer Underflow (Wrap or Wraparound)
The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow unsigned length calculations and read or write outside the document buffer. An actor who ca
- 8.8 High severity
libmongocrypt: Access of Resource Using Incompatible Type
Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a ser
- 8.4 High severity
Python Driver: Integer Overflow or Wraparound
An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bi
- 7.1 High severity
Compass: Improper Control of Generation of Code
MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to
- 7.1 High severity
Laravel MongoDB (PHP): Improper Neutralization of Special Elements in Data Query Logic
Improper neutralization of special elements in data query logic in the cache lock implementation of the MongoDB integration for Laravel can cause a caller-supplied lock owner value to be evaluated as an aggregation expression rather than as a literal value. An
- 9.8 Critical severity
Mongoid: Use of Externally-Controlled Input to Select Classes or Code
Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to certain in-memory query methods may allow an unauthenticated party to obtain unintended disclosure of
- 7.5 High severity
Mongoid: Inefficient Regular Expression Complexity
An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated party to cause excessive processing within an embedding application process. Applications that place user-supplie
- 8.2 High severity
Mongoid: Improper Neutralization of Special Elements in Data Query Logic
Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In an application that forwards externally supplied filter parameters in this way, a party with no cred
- 8.6 High severity
Mongoid: Improper Control of Generation of Code
Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argu
- 9.1 Critical severity
Mongoid: Use of Externally-Controlled Input to Select Classes or Code
Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input whose keys are passed through from an unauthenticated party by an embedding application can cause unintended internal method invocation
- 8.1 High severity
Mongoid: Authorization Bypass Through User-Controlled Key
An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges to reference a record identifier that is not their own. Processing such a request can cause that reco
- 8.1 High severity
C Driver: Out-of-bounds Write
A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built with the Windows platform TLS backend. A remote endpoint that the client connects to can cause the driver to write uncontrolled data outside the bounds of a heap
- 7.5 High severity
MongoDB Server: Concurrent Execution using Shared Resource with Improper Synchronization
A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory without synchronization, leading to memory corruption. An authenticated user holding ordinary read-write privileges on a d
- 8.3 High severity
C Driver: Improper Neutralization of Special Elements in Data Query Logic
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated
- 8.3 High severity
C++ Driver: Improper Neutralization of Special Elements in Data Query Logic
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C++ Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticate
- 8.3 High severity
Java Driver: Improper Neutralization of Special Elements in Data Query Logic
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticat
- 7.5 High severity
Java Driver: Use After Free
A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted operation is still using them when the operation is cancelled. A party able to cause such an operati