CVE-2026-120812 · Runtime
NO FIX YET
MongoDB Server's query compiler recurses without limit when it processes certain queries against time-series collections. A user with read access can send such a query and make the server process stop.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Deployments running MongoDB Server that have time-series collections and users or applications with read privileges. Attackers need an authenticated account with read access; the sources do not say which versions are affected beyond this description, so check the vendor advisory.
Not affected if no-time-series-collections, no-untrusted-read-users
Who cares databases, mongodb, self-hosted
db.version() in the mongo shell and compare against the fixed versions the sources name (unknown in the sources given).No fix yet, per the sources.
An issue in MongoDB Server's query processing component allows an authenticated user with read privileges to cause a denial of service. Uncontrolled recursion in an internal query compilation component can lead to stack exhaustion and server process termination when processing certain queries against time-series collections.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.