{"id":"CVE-2026-120818","kind":"vulnerability","aliases":["CVE-2026-120818"],"related":[],"title":"MongoDB Server: aggregation JavaScript use-after-free leaks process memory to users","description":"A use-after-free weakness in MongoDB Server's server-side JavaScript support for aggregation may allow a stale reference to previously freed process memory to be read and returned. An authenticated user with minimal or no assigned roles can trigger this condition over the normal network protocol by submitting a single crafted aggregation request, with no additional privileges or non-default configuration. Successful triggering this issue may result in adjacent process memory contents being returned, including data that undermines memory-layout randomization, and may in some cases affect server availability.","summary":"A use-after-free bug in MongoDB Server's server-side JavaScript support for aggregation can return freed process memory to the requester. An authenticated user with minimal roles can send one crafted aggregation request to read adjacent memory, which can weaken memory-layout randomization and may crash the server.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"MongoDB Server","fixed":["8.3.16","8.0.37","7.0.48"],"affected":">= 8.3.0, < 8.3.16 || >= 8.0.0, < 8.0.37 || >= 7.0.0, < 7.0.48","ecosystem":"vendor"}],"ecosystems":[],"tags":["database","mongodb","runtime","self-hosted"],"not_affected_if":["auth-required"],"how_to_check":"Run db.version() in mongosh (or mongod --version) on every mongod/mongos. Exposed if the version is >= 8.3.0 and < 8.3.16, >= 8.0.0 and < 8.0.37, or >= 7.0.0 and < 7.0.48. MongoDB says no non-default configuration is needed, so no setting has been found that avoids it. Any authenticated user, even with minimal roles, can trigger it. Managed services (e.g. Atlas) are not covered by the source; check with the provider.","fix":"Upgrade MongoDB Server to 8.3.16 (8.3 branch), 8.0.37 (8.0 branch) or 7.0.48 (7.0 branch) or later.","status":"open","published_at":"2026-11-10T21:19:00+00:00","first_seen_at":"2026-11-10T21:46:14+00:00","triaged_at":"2026-11-10T21:48:27+00:00","updated_at":"2026-11-10T21:52:25+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-10T21:48:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"MongoDB Server: aggregation JavaScript use-after-free leaks process memory to users","impact":"medium","summary":"A use-after-free bug in MongoDB Server's server-side JavaScript support for aggregation can return freed process memory to the requester. An authenticated user with minimal roles can send one crafted aggregation request to read adjacent memory, which can weaken memory-layout randomization and may crash the server.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["mongodb","self-hosted","database"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"adjacent process memory returned; server may crash","analyst_note":"Find the affected and fixed MongoDB Server versions and any server-side JavaScript setting from the MongoDB advisory for CVE-2026-120818 (NVD link in sources).","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["auth-required"],"who_is_affected":"Any deployment of MongoDB Server where users can submit aggregation requests, including low-privilege accounts, can be exposed. The sources do not state which versions are affected, and they do not say whether a non-default setting is needed beyond server-side JavaScript being available. Teams using only managed or unrelated services can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000717,"input_tokens":4623,"output_tokens":510,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed MongoDB Server versions and any server-side JavaScript setting from the MongoDB advisory for CVE-2026-120818 (NVD link in sources).","search":"'-120818':16A,19A '-2026':15A,18A 'addit':140C 'adjac':67B,154C 'affect':173C 'aggreg':3A,44B,63B,97C,136C 'allow':99C 'assign':120C 'authent':54B,114C 'avail':175C 'bug':33B 'case':172C 'condit':125C 'configur':146C 'content':157C 'craft':62B,135C 'crash':78B 'cve':14A,17A 'data':161C 'databas':22B 'default':145C 'free':8A,32B,85C 'freed':47B,105C 'host':27B 'includ':160C 'issu':150C 'javascript':4A,41B,94C 'layout':74B,166C 'leak':9A 'may':77B,98C,151C,169C 'memori':11A,49B,68B,73B,107C,156C,165C 'memory-layout':72B,164C 'minim':57B,117C 'mongodb':1A,20A,23B,35B,88C 'network':129C 'non':144C 'non-default':143C 'normal':128C 'one':61B 'previous':104C 'privileg':141C 'process':10A,48B,106C,155C 'protocol':130C 'random':75B,167C 'read':66B,110C 'refer':102C 'request':52B,64B,137C 'result':152C 'return':46B,112C,159C 'role':58B,121C 'runtim':24B 'self':26B 'self-host':25B 'send':60B 'server':2A,21A,36B,39B,80B,89C,92C,174C 'server-sid':38B,91C 'side':40B,93C 'singl':134C 'stale':101C 'submit':132C 'success':147C 'support':42B,95C 'trigger':123C,148C 'undermin':163C 'use':6A,30B,83C 'use-after-fre':5A,29B,82C 'user':13A,55B,115C 'weak':86C 'weaken':71B","nicknames":[],"mitigations":[],"who_affected":"Self-managed MongoDB Server deployments on 7.0 before 7.0.48, 8.0 before 8.0.37 or 8.3 before 8.3.16. Any authenticated user, even with minimal or no roles, can send one crafted aggregation request over the normal protocol to read adjacent process memory, which can weaken memory-layout randomization and may affect availability. Unauthenticated clients can skip it if auth is enforced, and so can teams on fixed versions.","tier":"B","verified":{"fix":{"at":"2026-11-10T21:52:25Z","by":"analyst","doc":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-120818","run_id":2873},"products":{"at":"2026-11-10T21:52:25Z","by":"analyst","doc":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-120818","run_id":2873},"who_affected":{"at":"2026-11-10T21:52:25Z","by":"analyst","doc":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-120818","run_id":2873}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["mongodbserver","server"],"ptokens":["mongodb","server"],"labels":["database","high","mongodb","runtime","selfhosted"],"campaign_type":null,"search_a":"'-120818':16A,19A '-2026':15A,18A 'aggreg':3A 'cve':14A,17A 'free':8A 'javascript':4A 'leak':9A 'memori':11A 'mongodb':1A,20A 'process':10A 'server':2A,21A 'use':6A 'use-after-fre':5A 'user':13A","search_b":"'adjac':67B 'aggreg':44B,63B 'authent':54B 'bug':33B 'craft':62B 'crash':78B 'databas':22B 'free':32B 'freed':47B 'host':27B 'javascript':41B 'layout':74B 'may':77B 'memori':49B,68B,73B 'memory-layout':72B 'minim':57B 'mongodb':23B,35B 'one':61B 'process':48B 'random':75B 'read':66B 'request':52B,64B 'return':46B 'role':58B 'runtim':24B 'self':26B 'self-host':25B 'send':60B 'server':36B,39B,80B 'server-sid':38B 'side':40B 'support':42B 'use':30B 'use-after-fre':29B 'user':55B 'weaken':71B","search_c":"'addit':140C 'adjac':154C 'affect':173C 'aggreg':97C,136C 'allow':99C 'assign':120C 'authent':114C 'avail':175C 'case':172C 'condit':125C 'configur':146C 'content':157C 'craft':135C 'data':161C 'default':145C 'free':85C 'freed':105C 'includ':160C 'issu':150C 'javascript':94C 'layout':166C 'may':98C,151C,169C 'memori':107C,156C,165C 'memory-layout':164C 'minim':117C 'mongodb':88C 'network':129C 'non':144C 'non-default':143C 'normal':128C 'previous':104C 'privileg':141C 'process':106C,155C 'protocol':130C 'random':167C 'read':110C 'refer':102C 'request':137C 'result':152C 'return':112C,159C 'role':121C 'server':89C,92C,174C 'server-sid':91C 'side':93C 'singl':134C 'stale':101C 'submit':132C 'success':147C 'support':95C 'trigger':123C,148C 'undermin':163C 'use':83C 'use-after-fre':82C 'user':115C 'weak':86C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:19:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120818","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120818","severity":null,"published_at":"2026-11-10T21:19:00+00:00","modified_at":"2026-11-10T21:19:00+00:00","first_seen_at":"2026-11-10T21:46:14+00:00","fetched_at":"2026-11-10T21:46:14+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120818:2873","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-120818","severity":null,"published_at":"2026-11-10T21:52:25+00:00","modified_at":"2026-11-10T21:52:25+00:00","first_seen_at":"2026-11-10T21:52:25+00:00","fetched_at":"2026-11-10T21:52:25+00:00","note":"Versions from MongoDB's own CNA record via NVD API (jira SERVER-135727 referenced, not read in full). No server-side JS setting named in source; description says no non-default config needed. No PoC or exploitation reported. X and vendor advisory page not searched.","cites":["https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-120818","https://jira.mongodb.org/browse/SERVER-135727"]}],"documents":[{"id":119304,"url":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-120818","title":"NVD record for CVE-2026-120818 (CNA: MongoDB)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":119306,"url":"https://jira.mongodb.org/browse/SERVER-135727","title":"MongoDB SERVER-135727 (referenced by CVE)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}