Live › vulnerability › CVE-2026-115930
Go to dashboardThe mongosh shell ships a Node.js runtime whose TLS root certificate store contains eMudhra intermediate CA certificates that can be recovered. An attacker holding those keys could issue certificates that mongosh accepts as trusted.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 16:02 UTC. All times on this page are UTC.
Anyone running mongosh before 2.14.0 is affected, since the shell's TLS trust depends on the certificate store it carries. If mongosh is installed through npm, the trust store comes from the host's Node.js runtime, so that runtime must be updated too. Teams using only a current mongosh bundle or a patched Node.js can skip this.
No product ranges from the sources yet.
mongosh --version and confirm it is below 2.14.0node --version on the host and confirm it is below 24.22.12.14.0 or later, which bundles Node.js 24.22.1 or later24.22.1 or later separatelyEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The MongoDB Shell (mongosh) relies on Node.js as a third-party runtime that carries its own TLS root certificate store. This certificate store has the recoverable eMudhra intermediate CA certificates. This issue impacts MongoDB Shell (mongosh) versions prior to 2.14.0 and can be resolved by updating to mongosh 2.14.0 which bundles Node.js 24.22.1 or later. If mongosh is installed through npm, it uses the Node.js runtime installed on the host; update that runtime separately.
This page as .md · .json · in your agent: get_signal("CVE-2026-115930")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.