{"id":"CVE-2026-120819","kind":"vulnerability","aliases":["CVE-2026-120819"],"related":[],"title":"MongoDB Server: use-after-free in JavaScript execution leaks adjacent process memory","description":"A memory-management flaw in the server-side JavaScript execution component of MongoDB Server can allow an authenticated user holding only read privileges to cause the server to access memory that has already been released. By submitting a specially crafted database command that runs user-supplied JavaScript, the user can cause a bounded amount of adjacent process memory to be returned in the command's result. This results in the user obtaining information they are not authorized to access. Integrity and availability are not affected.","summary":"A memory-management flaw in MongoDB Server's server-side JavaScript execution lets a logged-in user with read-only rights make the server return a bounded amount of adjacent process memory in a command result. An attacker can read data they are not authorized to see, but cannot change data or take the server down.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","mongodb","self-hosted","vendor"],"not_affected_if":["auth-required","default-config"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T21:19:00+00:00","first_seen_at":"2026-11-10T21:46:14+00:00","triaged_at":"2026-11-10T21:49:56+00:00","updated_at":"2026-11-10T21:49:56+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-10T21:49:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"MongoDB Server: use-after-free in JavaScript execution leaks adjacent process memory","impact":"low","summary":"A memory-management flaw in MongoDB Server's server-side JavaScript execution lets a logged-in user with read-only rights make the server return a bounded amount of adjacent process memory in a command result. An attacker can read data they are not authorized to see, but cannot change data or take the server down.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["mongodb","self-hosted","database"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Adjacent process memory leaks to a read-only authenticated user","analyst_note":"Check the MongoDB security advisory (linked from the NVD entry) for affected version ranges, fixed versions, and whether server-side JavaScript must be enabled.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["auth-required","default-config"],"who_is_affected":"Deployments of MongoDB Server where users hold read privileges and can run database commands that execute user-supplied JavaScript. Systems with no authenticated users, or where server-side JavaScript is disabled, are less exposed. The sources do not state affected version ranges.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000708,"input_tokens":4596,"output_tokens":496,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120819':16A,19A '-2026':15A,18A 'access':115C,166C 'adjac':11A,59B,143C 'affect':172C 'allow':102C 'alreadi':119C 'amount':57B,141C 'attack':67B 'authent':104C 'author':74B,164C 'avail':169C 'bound':56B,140C 'cannot':78B 'caus':111C,138C 'chang':79B 'command':64B,128C,151C 'compon':97C 'craft':126C 'cve':14A,17A 'data':70B,80B 'databas':20B,127C 'execut':9A,39B,96C 'flaw':30B,89C 'free':6A 'hold':106C 'host':24B 'inform':160C 'integr':167C 'javascript':8A,38B,95C,134C 'leak':10A 'let':40B 'log':43B 'logged-in':42B 'make':51B 'manag':29B,88C 'memori':13A,28B,61B,87C,116C,145C 'memory-manag':27B,86C 'mongodb':1A,21B,32B,99C 'obtain':159C 'privileg':109C 'process':12A,60B,144C 'read':48B,69B,108C 'read-on':47B 'releas':121C 'result':65B,153C,155C 'return':54B,148C 'right':50B 'run':130C 'see':76B 'self':23B 'self-host':22B 'server':2A,33B,36B,53B,84B,93C,100C,113C 'server-sid':35B,92C 'side':37B,94C 'special':125C 'submit':123C 'suppli':133C 'take':82B 'use':4A 'use-after-fre':3A 'user':45B,105C,132C,136C,158C 'user-suppli':131C 'vendor':25B","nicknames":[],"mitigations":[],"who_affected":"Deployments of MongoDB Server where users hold read privileges and can run database commands that execute user-supplied JavaScript. Systems with no authenticated users, or where server-side JavaScript is disabled, are less exposed. The sources do not state affected version ranges.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["database","medium","mongodb","selfhosted","vendor"],"campaign_type":null,"search_a":"'-120819':16A,19A '-2026':15A,18A 'adjac':11A 'cve':14A,17A 'execut':9A 'free':6A 'javascript':8A 'leak':10A 'memori':13A 'mongodb':1A 'process':12A 'server':2A 'use':4A 'use-after-fre':3A","search_b":"'adjac':59B 'amount':57B 'attack':67B 'author':74B 'bound':56B 'cannot':78B 'chang':79B 'command':64B 'data':70B,80B 'databas':20B 'execut':39B 'flaw':30B 'host':24B 'javascript':38B 'let':40B 'log':43B 'logged-in':42B 'make':51B 'manag':29B 'memori':28B,61B 'memory-manag':27B 'mongodb':21B,32B 'process':60B 'read':48B,69B 'read-on':47B 'result':65B 'return':54B 'right':50B 'see':76B 'self':23B 'self-host':22B 'server':33B,36B,53B,84B 'server-sid':35B 'side':37B 'take':82B 'user':45B 'vendor':25B","search_c":"'access':115C,166C 'adjac':143C 'affect':172C 'allow':102C 'alreadi':119C 'amount':141C 'authent':104C 'author':164C 'avail':169C 'bound':140C 'caus':111C,138C 'command':128C,151C 'compon':97C 'craft':126C 'databas':127C 'execut':96C 'flaw':89C 'hold':106C 'inform':160C 'integr':167C 'javascript':95C,134C 'manag':88C 'memori':87C,116C,145C 'memory-manag':86C 'mongodb':99C 'obtain':159C 'privileg':109C 'process':144C 'read':108C 'releas':121C 'result':153C,155C 'return':148C 'run':130C 'server':93C,100C,113C 'server-sid':92C 'side':94C 'special':125C 'submit':123C 'suppli':133C 'user':105C,132C,136C,158C 'user-suppli':131C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:19:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120819","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120819","severity":null,"published_at":"2026-11-10T21:19:00+00:00","modified_at":"2026-11-10T21:19:00+00:00","first_seen_at":"2026-11-10T21:46:14+00:00","fetched_at":"2026-11-10T21:46:14+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}