MONGODB SERVER · CVE-2026-118383 · Vendor
FIX → 9.0.7 · 8.3.16 · 7.0.48 · 6.0.30 +3 ✓ verified
A use-after-free bug in MongoDB Server's replication component happens when a newly elected primary finishes catch-up. Requests that need no login can crash the server or, under certain conditions, run arbitrary code inside the server process.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Self-hosted MongoDB Server deployments that run as a replica set, including the shard and config server replica sets of sharded clusters. The flaw is reachable by requests that need no login, so network exposure of mongod matters. Standalone mongod instances are not affected, and the sources do not say whether Atlas is affected.
Not affected if standalone-mongod
Who cares mongodb, replica-set, self-hosted, sharded-cluster
9.0.7, 8.3.16, 8.0.37, 7.0.48, 6.0.30, 5.0.35 or 4.4.32 on the same release line are affected if the member is in a replica setA use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up. The condition can be caused by requests that do not require authentication, and may result in the server terminating unexpectedly or, under certain conditions, arbitrary code execution in the context of the server process. Replica set members are affected, including the shard and config server replica set members of sharded clusters; standalone mongod instances are not.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 9.0.7 · 8.3.16 · 7.0.48 · 6.0.30 +3
Upgrade to MongoDB 9.0.7, 8.3.16, 8.0.37, 7.0.48, 6.0.30, 5.0.35 or 4.4.32 (the fix versions on MongoDB's SERVER-138119).