CVE-2026-120811 · Package
NO FIX YET
A use-after-free bug in MongoDB's classic query engine plan cache lets a diagnostic command read freed heap memory. An authenticated client may receive sensitive server process memory contents, and under some heap reuse conditions the server can crash.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Affects MongoDB servers using the classic query engine plan cache, reached by a client that already has valid credentials. Exposure depends on the query conditions and diagnostic commands in use, which the sources do not detail. Deployments that run only managed MongoDB services where the vendor patches the server are not the team's to fix.
Not affected if auth-required
Who cares database, mongodb, self-hosted
Unknown from the sources.
No fix yet, per the sources.
A use-after-free issue exists in the MongoDB server’s classic query engine plan cache. Under certain query conditions, an unowned reference to data from an earlier command can be retained in cached plan statistics. After the originating memory is freed, a subsequent diagnostic command serializing those statistics can read freed heap memory, potentially returning sensitive server process memory contents to the authenticated client. Under certain heap reuse conditions, this may also cause the server to crash.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.