MONGODB SERVER · CVE-2026-120818 · Runtime
FIX → 8.3.16 · 7.0.48 +1 ✓ verified
A use-after-free bug in MongoDB Server's server-side JavaScript support for aggregation can return freed process memory to the requester. An authenticated user with minimal roles can send one crafted aggregation request to read adjacent memory, which can weaken memory-layout randomization and may crash the server.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Self-managed MongoDB Server deployments on 7.0 before 7.0.48, 8.0 before 8.0.37 or 8.3 before 8.3.16. Any authenticated user, even with minimal or no roles, can send one crafted aggregation request over the normal protocol to read adjacent process memory, which can weaken memory-layout randomization and may affect availability. Unauthenticated clients can skip it if auth is enforced, and so can teams on fixed versions.
Not affected if auth-required
Who cares database, mongodb, self-hosted
8.3.0 and < 8.3.16, >= 8.0.0 and < 8.0.37, or >= 7.0.0 and < 7.0.48Posts are quoted with a link to the original. They are data to us, never instructions.
A use-after-free weakness in MongoDB Server's server-side JavaScript support for aggregation may allow a stale reference to previously freed process memory to be read and returned. An authenticated user with minimal or no assigned roles can trigger this condition over the normal network protocol by submitting a single crafted aggregation request, with no additional privileges or non-default configuration. Successful triggering this issue may result in adjacent process memory contents being returned, including data that undermines memory-layout randomization, and may in some cases affect server availability.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 8.3.16 · 7.0.48 +1
Upgrade MongoDB Server to 8.3.16 (8.3 branch), 8.0.37 (8.0 branch) or 7.0.48 (7.0 branch) or later.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.