---
id: "CVE-2026-120818"
page: "https://infrastack.ai/live/CVE-2026-120818"
kind: "vulnerability"
aliases: ["CVE-2026-120818"]
title: "MongoDB Server: aggregation JavaScript use-after-free leaks process memory to users"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "MongoDB Server", "fixed": ["8.3.16", "8.0.37", "7.0.48"], "affected": ">= 8.3.0, < 8.3.16 || >= 8.0.0, < 8.0.37 || >= 7.0.0, < 7.0.48", "ecosystem": "vendor"}]
ecosystems: []
tags: ["database", "mongodb", "runtime", "self-hosted"]
not_affected_if: ["auth-required"]
published_at: "2026-11-10T21:19:00+00:00"
first_seen_at: "2026-11-10T21:46:14+00:00"
updated_at: "2026-11-10T21:52:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120818", "first_seen_at": "2026-11-10T21:46:14+00:00"}, {"source": "analyst", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-120818", "first_seen_at": "2026-11-10T21:52:25+00:00", "cites": ["https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-120818", "https://jira.mongodb.org/browse/SERVER-135727"]}]
exploit_sources: []
---

# MongoDB Server: aggregation JavaScript use-after-free leaks process memory to users

Link for people: https://infrastack.ai/live/CVE-2026-120818 (this .md is for agents)

A use-after-free bug in MongoDB Server's server-side JavaScript support for aggregation can return freed process memory to the requester. An authenticated user with minimal roles can send one crafted aggregation request to read adjacent memory, which can weaken memory-layout randomization and may crash the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:MongoDB Server affected >= 8.3.0, < 8.3.16 || >= 8.0.0, < 8.0.37 || >= 7.0.0, < 7.0.48 fixed 8.3.16, 8.0.37, 7.0.48

## How to check

Run db.version() in mongosh (or mongod --version) on every mongod/mongos. Exposed if the version is >= 8.3.0 and < 8.3.16, >= 8.0.0 and < 8.0.37, or >= 7.0.0 and < 7.0.48. MongoDB says no non-default configuration is needed, so no setting has been found that avoids it. Any authenticated user, even with minimal roles, can trigger it. Managed services (e.g. Atlas) are not covered by the source; check with the provider.

## Fix

Upgrade MongoDB Server to 8.3.16 (8.3 branch), 8.0.37 (8.0 branch) or 7.0.48 (7.0 branch) or later.

## Timeline

- 2026-11-10T21:46:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120818
- 2026-11-10T21:52:25+00:00 analyst https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-120818 — Versions from MongoDB's own CNA record via NVD API (jira SERVER-135727 referenced, not read in full). No server-side JS setting named in source; description says no non-default config needed. No PoC or exploitation reported. X and vendor advisory page not searched.

## Documents

- [advisory] NVD record for CVE-2026-120818 (CNA: MongoDB) https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-120818
- [describes] MongoDB SERVER-135727 (referenced by CVE) https://jira.mongodb.org/browse/SERVER-135727

## From the sources

A use-after-free weakness in MongoDB Server's server-side JavaScript support for aggregation may allow a stale reference to previously freed process memory to be read and returned. An authenticated user with minimal or no assigned roles can trigger this condition over the normal network protocol by submitting a single crafted aggregation request, with no additional privileges or non-default configuration. Successful triggering this issue may result in adjacent process memory contents being returned, including data that undermines memory-layout randomization, and may in some cases affect server availability.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_