Who is not affected by CVE-2026-120819?

Q: Who is not affected by CVE-2026-120819?

Not affected if: auth-required, default-config.

MEDIUM5.3CVSS · cna@mongodb.com

NO KNOWN
EXPLOIT

CVE-2026-120819 · Vendor

MongoDB Server: use-after-free in JavaScript execution leaks adjacent process memory

NO FIX YET

A memory-management flaw in MongoDB Server's server-side JavaScript execution lets a logged-in user with read-only rights make the server return a bounded amount of adjacent process memory in a command result. An attacker can read data they are not authorized to see, but cannot change data or take the server down.

Full story ↓Less ↑

first public Nov 10, 2026 · 1 source

Could this affect your app?

Free first check from your website. Connect your repo for the full answer.

01 · Who is affected

Deployments of MongoDB Server where users hold read privileges and can run database commands that execute user-supplied JavaScript. Systems with no authenticated users, or where server-side JavaScript is disabled, are less exposed. The sources do not state affected version ranges.

Not affected if auth-required, default-config

Who cares database, mongodb, self-hosted

02 · How to check

Unknown from the sources.

03 · The fix

No fix yet, per the sources.

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 10, 2026

What the sources say, verbatim

539 characters

A memory-management flaw in the server-side JavaScript execution component of MongoDB Server can allow an authenticated user holding only read privileges to cause the server to access memory that has already been released. By submitting a specially crafted database command that runs user-supplied JavaScript, the user can cause a bounded amount of adjacent process memory to be returned in the command's result. This results in the user obtaining information they are not authorized to access. Integrity and availability are not affected.

Sources and references

NVD: CVE-2026-120819Nov 10, 2026

This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.

Check it with your coding agent

It reads this page and tells you if your code is affected.

Claude CodeCodexCursorAdd to your agent

Are you affected?

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

Run the check