---
id: "CVE-2026-120819"
page: "https://infrastack.ai/live/CVE-2026-120819"
kind: "vulnerability"
aliases: ["CVE-2026-120819"]
title: "MongoDB Server: use-after-free in JavaScript execution leaks adjacent process memory"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["database", "mongodb", "self-hosted", "vendor"]
not_affected_if: ["auth-required", "default-config"]
published_at: "2026-11-10T21:19:00+00:00"
first_seen_at: "2026-11-10T21:46:14+00:00"
updated_at: "2026-11-10T21:49:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120819", "first_seen_at": "2026-11-10T21:46:14+00:00"}]
exploit_sources: []
---

# MongoDB Server: use-after-free in JavaScript execution leaks adjacent process memory

Link for people: https://infrastack.ai/live/CVE-2026-120819 (this .md is for agents)

A memory-management flaw in MongoDB Server's server-side JavaScript execution lets a logged-in user with read-only rights make the server return a bounded amount of adjacent process memory in a command result. An attacker can read data they are not authorized to see, but cannot change data or take the server down.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T21:46:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120819

## From the sources

A memory-management flaw in the server-side JavaScript execution component of MongoDB Server can allow an authenticated user holding only read privileges to cause the server to access memory that has already been released. By submitting a specially crafted database command that runs user-supplied JavaScript, the user can cause a bounded amount of adjacent process memory to be returned in the command's result. This results in the user obtaining information they are not authorized to access. Integrity and availability are not affected.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_