MONGODB SERVER · CVE-2026-120821 · Package
FIX → 9.0.7 ✓ verified
A use-after-free in MongoDB Server 9.0's aggregation framework: cloned expressions ($sortArray, $topN, $top, $bottom, $bottomN) keep a pointer to a collator that can be freed with the original expression context. An authenticated user with read privileges can make the server terminate. Fixed in 9.0.7.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Self-run MongoDB Server 9.0.0 to 9.0.6 where untrusted or low-privilege users can authenticate and run aggregations; a read-only account is enough to crash the server. The Jira ticket traces the bug to a change added in 9.0, so earlier lines (7.0, 8.0, 8.3) are not listed as affected; the CVE text itself gives no version list. Skip it if you are not on 9.0 or no untrusted accounts can query.
Not affected if mongodb-7.0, mongodb-8.0, no-authenticated-readers
Who cares database, mongodb, mongodb-9.0, self-hosted
9.0.0 through 9.0.6. 7.0, 8.0 and 8.3 are not listed: the bug comes from the clone() change in SERVER-119491, added in 9.0Upgrade to 9.0.7
A use-after-free in the aggregation framework of MongoDB Server can occur when certain expressions are evaluated in an aggregation sub-pipeline. The condition can be caused by an authenticated user with read privileges, and may result in the server terminating unexpectedly.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade MongoDB Server 9.0 to 9.0.7 or later (SERVER-136285 Fix Version 9.0.7).