{"id":"CVE-2026-119179","kind":"vulnerability","aliases":["CVE-2026-119179"],"related":[],"title":"MongoDB Node.js driver: pooled connections can mix up replies between requests","description":"A flaw in the connection management layer of the MongoDB Node.js driver can leave a pooled network connection in the pool for reuse while data from an earlier operation is still outstanding on it. In applications that enable an optional client-side operation timeout, an unauthenticated party that can send ordinary requests to the application may cause database replies to be paired with the wrong requests. This may result in unintended disclosure of other users' records, incorrect operation results being returned, and failures of legitimate requests.","summary":"The MongoDB Node.js driver can return a pooled connection for reuse while an earlier operation's data is still pending on it. In applications with a client-side operation timeout enabled, an unauthenticated user sending ordinary requests may get other users' records or wrong results.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mongodb","fixed":["6.22.0","7.8.0"],"affected":">= 6.11.0, < 6.22.0 || >= 7.0.0, < 7.8.0","ecosystem":"npm"}],"ecosystems":[],"tags":["mongodb","node.js","nodejs-driver","npm","package","timeoutms","web-apps"],"not_affected_if":["driver-6.22.0-or-7.8.0-or-later","no-unauthenticated-requests","timeout-not-enabled"],"how_to_check":"- Run `npm ls mongodb`. Affected: 6.11.0 up to but not including 6.22.0, and 7.0.0 up to but not including 7.8.0. Versions before 6.11.0 are not listed as affected.\n- Search your code for `timeoutMS` (MongoClient options, or per-operation options). MongoDB's notice names the timeoutMS feature as the trigger. If you never set it, you are not using the affected feature.\n- `maxTimeMS` is the server-side limit that MongoDB recommends as an alternative. It is not named as the trigger.","fix":"Upgrade the mongodb npm package to 6.22.0 (6.x line) or 7.8.0 (7.x line). Both releases make timeoutMS and timeoutMode deprecated no-ops, so operations no longer time out because of them. Until you upgrade, stop using timeoutMS.","status":"open","published_at":"2026-11-03T14:17:33+00:00","first_seen_at":"2026-11-03T14:21:08+00:00","triaged_at":"2026-11-03T14:22:01+00:00","updated_at":"2026-11-03T14:22:46+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-03T14:22:01Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"MongoDB Node.js driver: pooled connections can mix up replies between requests","impact":"high","summary":"The MongoDB Node.js driver can return a pooled connection for reuse while an earlier operation's data is still pending on it. In applications with a client-side operation timeout enabled, an unauthenticated user sending ordinary requests may get other users' records or wrong results.","audience":"developers","category":"package","nicknames":[],"who_cares":["mongodb","node.js","nodejs-driver","web-apps"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"other users' database records disclosed to unauthenticated requesters","analyst_note":"Sources give no affected or fixed driver versions; check the NVD entry and the MongoDB driver release notes for the fixed version.","how_to_check":"- Check the installed driver version with `npm ls mongodb` in the application.\n- Check whether the application sets a client-side operation timeout (for example `timeoutMS` or `maxTimeMS` options on the MongoDB client).","plain_action":"","needs_analyst":true,"not_affected_if":["timeout-not-enabled","no-unauthenticated-requests"],"who_is_affected":"Applications that use the MongoDB Node.js driver and enable the optional client-side operation timeout, and that let unauthenticated users send requests reaching the database. Applications without that timeout enabled, or without unauthenticated request paths, are less exposed. The sources do not list affected driver version ranges.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000702,"input_tokens":4179,"output_tokens":569,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources give no affected or fixed driver versions; check the NVD entry and the MongoDB driver release notes for the fixed version.","search":"'-119179':14A,17A '-2026':13A,16A 'app':29B 'applic':53B,111C,131C 'caus':133C 'client':57B,117C 'client-sid':56B,116C 'connect':5A,38B,80C,93C 'cve':12A,15A 'data':46B,100C 'databas':134C 'disclosur':148C 'driver':3A,23B,33B,87C 'earlier':43B,103C 'enabl':61B,113C 'failur':159C 'flaw':77C 'get':69B 'incorrect':153C 'layer':82C 'leav':89C 'legitim':161C 'manag':81C 'may':68B,132C,144C 'mix':7A 'mongodb':1A,18A,19B,31B,85C 'network':92C 'node.js':2A,20B,32B,86C 'nodej':22B 'nodejs-driv':21B 'npm':24B 'oper':44B,59B,104C,119C,154C 'option':115C 'ordinari':66B,127C 'outstand':107C 'packag':25B 'pair':138C 'parti':123C 'pend':49B 'pool':4A,37B,91C,96C 'record':72B,152C 'repli':9A,135C 'request':11A,67B,128C,142C,162C 'result':75B,145C,155C 'return':35B,157C 'reus':40B,98C 'send':65B,126C 'side':58B,118C 'still':48B,106C 'timeout':60B,120C 'timeoutm':26B 'unauthent':63B,122C 'unintend':147C 'user':64B,71B,151C 'web':28B 'web-app':27B 'wrong':74B,141C","nicknames":[],"mitigations":[],"who_affected":"Node.js apps that use the official mongodb driver at 6.11.0 to 6.21.x or 7.0.0 to 7.7.x and set the timeoutMS option. After an operation times out, the connection pool can get out of sync, and MongoDB says this can expose other users' data. Apps that never set timeoutMS, or that use other driver versions, can skip this. The NVD text says the trigger can be ordinary requests from an unauthenticated user, so internet-facing apps matter most.","tier":"B","verified":{"fix":{"at":"2026-11-03T14:22:46Z","by":"analyst","doc":"https://github.com/mongodb/node-mongodb-native/releases/","run_id":1489},"products":{"at":"2026-11-03T14:22:46Z","by":"analyst","doc":"https://github.com/mongodb/node-mongodb-native/releases/","run_id":1489},"how_to_check":{"at":"2026-11-03T14:22:46Z","by":"analyst","doc":"https://github.com/mongodb/node-mongodb-native/releases/","run_id":1489},"who_affected":{"at":"2026-11-03T14:22:46Z","by":"analyst","doc":"https://github.com/mongodb/node-mongodb-native/releases/","run_id":1489}},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["mongodb"],"ptokens":["mongodb"],"labels":["high","mongodb","nodejs","nodejsdriver","npm","package","timeoutms","webapps"],"first_public_at":"2026-11-03T14:17:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119179","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119179","severity":null,"published_at":"2026-11-03T14:17:33+00:00","modified_at":"2026-11-03T14:17:33+00:00","first_seen_at":"2026-11-03T14:21:08+00:00","fetched_at":"2026-11-03T14:21:08+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119179:1489","url":null,"severity":null,"published_at":"2026-11-03T14:22:46+00:00","modified_at":"2026-11-03T14:22:46+00:00","first_seen_at":"2026-11-03T14:22:46+00:00","fetched_at":"2026-11-03T14:22:46+00:00","note":"Read MongoDB's own GitHub release notes for 6.22.0 and 7.8.0: affected ranges, timeoutMS as the trigger, and the fix (timeoutMS made a no-op). Triage listed maxTimeMS as a trigger. The vendor names only timeoutMS, so I removed it. No exploitation or PoC found. I did not search social posts. The 'unauthenticated' wording comes from the NVD/CNA description and is not in the release notes."}],"documents":[{"id":58024,"url":"https://github.com/mongodb/node-mongodb-native/releases/","title":"node-mongodb-native releases: 6.22.0 and 7.8.0 (timeoutMS security notice)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":58024,"url":"https://github.com/mongodb/node-mongodb-native/releases/","title":"node-mongodb-native releases: 6.22.0 and 7.8.0 (timeoutMS security notice)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":58025,"url":"https://app.opencve.io/cve/CVE-2026-119179","title":"OpenCVE: CVE-2026-119179","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}