---
id: "CVE-2026-119179"
kind: "vulnerability"
aliases: ["CVE-2026-119179"]
title: "MongoDB Node.js driver: pooled connections can mix up replies between requests"
severity: "high"
cvss: 8.3
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "mongodb", "fixed": ["6.22.0", "7.8.0"], "affected": ">= 6.11.0, < 6.22.0 || >= 7.0.0, < 7.8.0", "ecosystem": "npm"}]
ecosystems: []
tags: ["mongodb", "node.js", "nodejs-driver", "npm", "package", "timeoutms", "web-apps"]
not_affected_if: ["driver-6.22.0-or-7.8.0-or-later", "no-unauthenticated-requests", "timeout-not-enabled"]
published_at: "2026-11-03T14:17:33+00:00"
first_seen_at: "2026-11-03T14:21:08+00:00"
updated_at: "2026-11-03T14:22:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119179", "first_seen_at": "2026-11-03T14:21:08+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T14:22:46+00:00"}]
---

# MongoDB Node.js driver: pooled connections can mix up replies between requests

The MongoDB Node.js driver can return a pooled connection for reuse while an earlier operation's data is still pending on it. In applications with a client-side operation timeout enabled, an unauthenticated user sending ordinary requests may get other users' records or wrong results.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:mongodb affected >= 6.11.0, < 6.22.0 || >= 7.0.0, < 7.8.0 fixed 6.22.0, 7.8.0

## How to check

- Run `npm ls mongodb`. Affected: 6.11.0 up to but not including 6.22.0, and 7.0.0 up to but not including 7.8.0. Versions before 6.11.0 are not listed as affected.
- Search your code for `timeoutMS` (MongoClient options, or per-operation options). MongoDB's notice names the timeoutMS feature as the trigger. If you never set it, you are not using the affected feature.
- `maxTimeMS` is the server-side limit that MongoDB recommends as an alternative. It is not named as the trigger.

## Fix

Upgrade the mongodb npm package to 6.22.0 (6.x line) or 7.8.0 (7.x line). Both releases make timeoutMS and timeoutMode deprecated no-ops, so operations no longer time out because of them. Until you upgrade, stop using timeoutMS.

## Timeline

- 2026-11-03T14:21:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119179
- 2026-11-03T14:22:46+00:00 analyst — Read MongoDB's own GitHub release notes for 6.22.0 and 7.8.0: affected ranges, timeoutMS as the trigger, and the fix (timeoutMS made a no-op). Triage listed maxTimeMS as a trigger. The vendor names only timeoutMS, so I removed it. No exploitation or PoC found. I did not search social posts. The 'unauthenticated' wording comes from the NVD/CNA description and is not in the release notes.

## Documents

- [advisory] node-mongodb-native releases: 6.22.0 and 7.8.0 (timeoutMS security notice) https://github.com/mongodb/node-mongodb-native/releases/
- [fix] node-mongodb-native releases: 6.22.0 and 7.8.0 (timeoutMS security notice) https://github.com/mongodb/node-mongodb-native/releases/
- [mentions] OpenCVE: CVE-2026-119179 https://app.opencve.io/cve/CVE-2026-119179

## From the sources

A flaw in the connection management layer of the MongoDB Node.js driver can leave a pooled network connection in the pool for reuse while data from an earlier operation is still outstanding on it. In applications that enable an optional client-side operation timeout, an unauthenticated party that can send ordinary requests to the application may cause database replies to be paired with the wrong requests. This may result in unintended disclosure of other users' records, incorrect operation results being returned, and failures of legitimate requests.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_