MongoDB Server: Use-after-free in server-side JavaScript aggregation
Summary
A use-after-free weakness in the server-side JavaScript support for aggregation in MongoDB Server can cause stale references to freed process memory to be read and returned. An authenticated user with minimal or no assigned roles can trigger it with a single crafted aggregation request over the normal network protocol, without non-default configuration. Successful exploitation may expose adjacent process memory, including data that weakens memory-layout randomization, and may in some cases affect server availability.
Affected
- MongoDB Server 8.3.0 to before 8.3.16
- MongoDB Server 8.0.0 to before 8.0.37
- MongoDB Server 7.0.0 to before 7.0.48
- Default configuration is unaffected according to the CNA record.
- Version 9.0 is not listed in the CNA record; verify against the vendor ticket.
Fixed in
- Upgrade to 8.3.16 or later
- Upgrade to 8.0.37 or later
- Upgrade to 7.0.48 or later
Workaround
- No vendor-specific workaround found.
- General option, not confirmed by the vendor for this CVE: set security.javascriptEnabled to false in mongod.conf if applications do not use server-side JavaScript. This disables $where, $function, $accumulator and mapReduce.
- Restrict and review database accounts with access to the instance.
Exploitation
- No known exploitation in the wild at the time of research.
- Not listed in CISA KEV according to the sources checked.
- No public proof of concept found at the time of research.
Our recommendation
- Inventory all MongoDB instances and their versions.
- Prioritise instances that are internet-reachable or used with shared accounts.
- Upgrade to 8.3.16, 8.0.37 or 7.0.48 (or the 9.0 equivalent once confirmed with the vendor).
- Where patching must wait, disable server-side JavaScript on instances that do not need it and review account privileges.
- Monitor for unusual aggregation requests and authentication activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-120818 www.cve.org
- MongoDB Jira SERVER-135727 jira.mongodb.org
- MongoDB Docs: Server-side JavaScript www.mongodb.com
- OffSeq Radar CVE-2026-120818 radar.offseq.com
- Threatint CVE-2026-120818 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 07:06.
Original description (NVD)
A use-after-free weakness in MongoDB Server's server-side JavaScript support for aggregation may allow a stale reference to previously freed process memory to be read and returned. An authenticated user with minimal or no assigned roles can trigger this condition over the normal network protocol by submitting a single crafted aggregation request, with no additional privileges or non-default configuration. Successful triggering this issue may result in adjacent process memory contents being returned, including data that undermines memory-layout randomization, and may in some cases affect server availability.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.