MongoDB Server: Use-after-free in server-side JavaScript execution
Summary
A use-after-free flaw in the server-side JavaScript execution component of MongoDB Server allows an authenticated user with only read privileges to obtain a bounded amount of adjacent process memory. The attacker submits a crafted database command that runs user-supplied JavaScript, and the leaked memory is returned in the command result. Integrity and availability are not affected, but the attacker can read information they are not authorized to access.
Affected
- MongoDB Server 9.0.0 to before 9.0.7 (per CVE record)
- Versions of other branches (8.0, 7.0 and older): Unknown.
Fixed in
- MongoDB Server 9.0.7 (per Jira ticket reference and third-party aggregator)
- Patch releases for other branches: Unknown, check the vendor advisory.
Workaround
- No vendor-documented workaround.
- Interim measures (not vendor-stated): limit users with read roles, restrict who can run server-side JavaScript, keep MongoDB off public networks.
Exploitation
- No known exploitation reported at the time of analysis.
- Not listed in CISA KEV according to OpenCVE; CISA KEV not checked directly.
- No public proof of concept found.
Our recommendation
- Upgrade to MongoDB Server 9.0.7 or the current patch release for each branch in use, during the next maintenance window.
- Review which accounts and applications hold read roles and remove unnecessary access.
- Restrict server-side JavaScript use and ensure MongoDB is not reachable from untrusted networks.
- Monitor the vendor advisory SERVER-134893 and NVD for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-120819 www.cve.org
- MongoDB Jira ticket SERVER-134893 jira.mongodb.org
- OpenCVE CVE-2026-120819 app.opencve.io
- OffSeq Radar: CVE-2026-120819 radar.offseq.com
- threatint CVE-2026-120819 cve.threatint.com
- MongoDB security alerts www.mongodb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 18:16.
Original description (NVD)
A memory-management flaw in the server-side JavaScript execution component of MongoDB Server can allow an authenticated user holding only read privileges to cause the server to access memory that has already been released. By submitting a specially crafted database command that runs user-supplied JavaScript, the user can cause a bounded amount of adjacent process memory to be returned in the command's result. This results in the user obtaining information they are not authorized to access. Integrity and availability are not affected.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.