CVE-2026-120809 · Runtime
NO FIX YET
A use-after-free bug in MongoDB's SBE query engine, triggered by $unwind on time-series collections, can free memory that is still in use. An authenticated user can use this to read recycled server heap memory in query results or crash the server.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only deployments with the non-default SBE-related server parameter enabled are exposed, and only users with an account who can run aggregation pipelines against time-series collections. Teams running default configuration or without time-series $unwind queries can likely skip it. The sources do not list affected versions.
Not affected if default-config, no-time-series-collections
Who cares mongodb, self-hosted, time-series
unknownunknownNo fix yet, per the sources.
A use-after-free read issue exists in MongoDB’s SBE (Slot-Based Execution) engine when processing aggregation pipelines with $unwind on time-series collections. An internal error in state-preservation logic can cause a value still referenced by downstream stages to have its underlying memory freed prematurely. An authenticated user can craft an aggregation pipeline under specific conditions to trigger this condition, potentially reading recycled server heap memory in query results or crashing the server. This issue is only triggerable when a non-default server parameter related to the SBE engine is enabled.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.