Live › vulnerability › CVE-2026-119179
The MongoDB Node.js driver can return a pooled connection for reuse while an earlier operation's data is still pending on it. In applications with a client-side operation timeout enabled, an unauthenticated user sending ordinary requests may get other users' records or wrong results.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 14:21 UTC. All times on this page are UTC.
Node.js apps that use the official mongodb driver at 6.11.0 to 6.21.x or 7.0.0 to 7.7.x and set the timeoutMS option. After an operation times out, the connection pool can get out of sync, and MongoDB says this can expose other users' data. Apps that never set timeoutMS, or that use other driver versions, can skip this. The NVD text says the trigger can be ordinary requests from an unauthenticated user, so internet-facing apps matter most.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| mongodb | npm | >= 6.11.0, < 6.22.0 || >= 7.0.0, < 7.8.0 | 6.22.0, 7.8.0 |
npm ls mongodb. Affected: 6.11.0 up to but not including 6.22.0, and 7.0.0 up to but not including 7.8.0. Versions before 6.11.0 are not listed as affected.timeoutMS (MongoClient options, or per-operation options). MongoDB's notice names the timeoutMS feature as the trigger. If you never set it, you are not using the affected feature.maxTimeMS is the server-side limit that MongoDB recommends as an alternative. It is not named as the trigger.6.22.0 (6.x line) or 7.8.0 (7.x line)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw in the connection management layer of the MongoDB Node.js driver can leave a pooled network connection in the pool for reuse while data from an earlier operation is still outstanding on it. In applications that enable an optional client-side operation timeout, an unauthenticated party that can send ordinary requests to the application may cause database replies to be paired with the wrong requests. This may result in unintended disclosure of other users' records, incorrect operation results being returned, and failures of legitimate requests.
This page as .md · .json · in your agent: get_signal("CVE-2026-119179")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.