---
id: "CVE-2026-120809"
page: "https://infrastack.ai/live/CVE-2026-120809"
kind: "vulnerability"
aliases: ["CVE-2026-120809"]
title: "MongoDB: aggregation pipelines can read freed server memory or crash"
severity: "medium"
cvss: 6.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["mongodb", "runtime", "self-hosted", "time-series"]
not_affected_if: ["default-config", "no-time-series-collections"]
published_at: "2026-11-10T20:18:51+00:00"
first_seen_at: "2026-11-10T20:46:02+00:00"
updated_at: "2026-11-10T20:48:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120809", "first_seen_at": "2026-11-10T20:46:02+00:00"}]
exploit_sources: []
---

# MongoDB: aggregation pipelines can read freed server memory or crash

Link for people: https://infrastack.ai/live/CVE-2026-120809 (this .md is for agents)

A use-after-free bug in MongoDB's SBE query engine, triggered by $unwind on time-series collections, can free memory that is still in use. An authenticated user can use this to read recycled server heap memory in query results or crash the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the non-default SBE-related server parameter is enabled on the deployment; the sources do not name it, so `unknown`
- Check the running MongoDB version against the product ranges in the NVD entry: `unknown`

## Timeline

- 2026-11-10T20:46:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120809

## From the sources

A use-after-free read issue exists in MongoDB’s SBE (Slot-Based Execution) engine when processing aggregation pipelines with $unwind on time-series collections. An internal error in state-preservation logic can cause a value still referenced by downstream stages to have its underlying memory freed prematurely. An authenticated user can craft an aggregation pipeline under specific conditions to trigger this condition, potentially reading recycled server heap memory in query results or crashing the server. This issue is only triggerable when a non-default server parameter related to the SBE engine is enabled.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_