CVE-2026-120820 · Infrastructure
NO FIX YET
MongoDB Server keeps an in-memory table of per-namespace statistics for operations with encrypted-field information and adds an entry for every namespace named in a request, with no limit and no way to remove stale ones. A user with basic read privileges can send repeated read commands with made-up namespace names, causing the server process to grow in memory and slow down until it is restarted.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Deployments running MongoDB Server where users hold read privileges can trigger the growth, since the flawed table is filled by ordinary read commands naming arbitrary namespaces. Operators of single-tenant servers with only trusted read users are less exposed. The sources do not state which versions or configurations are affected beyond this description.
Not affected if no-untrusted-read-users
Who cares database, mongodb, self-hosted
mongod --version and compare it against the fixed versions belowUnknown from the sources.
MongoDB Server maintains an in-memory table of per-namespace statistics for operations that carry encrypted-field information. Entries are created for any namespace supplied in a request, with no limit on the number of entries and no way to remove entries that never corresponded to a real collection. A user with basic read privileges who repeatedly issues ordinary read commands referencing arbitrary namespace names may cause the server process to retain steadily increasing amounts of memory and to slow down on the affected code path; the memory is reclaimed only by restarting the process.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.