Node.js Driver vulnerabilities

2 known vulnerabilities in Node.js Driver from MongoDB. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.4 High severity

  Node.js Driver: Incorrect Behavior Order: Validate Before Canonicalize

  CVE-2026-126837Nov 12, 2026MongoDB

  A validation flaw in the DNS SRV host discovery of the MongoDB Node.js driver may cause the driver to connect to a host outside the expected domain. For a mongodb+srv:// connection string, the driver checks each host name in the DNS SRV response against the do

• 7.0 High severity

  Node.js Driver: Sensitive Information in Resource Not Removed Before Reuse

  CVE-2026-119179Nov 3, 2026MongoDB

  A flaw in the connection management layer of the MongoDB Node.js driver can leave a pooled network connection in the pool for reuse while data from an earlier operation is still outstanding on it. In applications that enable an optional client-side operation t