---
id: "CVE-2026-120821"
page: "https://infrastack.ai/live/CVE-2026-120821"
kind: "vulnerability"
aliases: ["CVE-2026-120821"]
title: "MongoDB Server: aggregation use-after-free lets a reader crash the server"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "MongoDB Server", "fixed": ["9.0.7"], "affected": ">= 9.0.0, < 9.0.7", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["database", "mongodb", "mongodb-9.0", "package", "self-hosted"]
not_affected_if: ["mongodb-7.0", "mongodb-8.0", "no-authenticated-readers"]
published_at: "2026-11-10T21:19:01+00:00"
first_seen_at: "2026-11-10T21:46:15+00:00"
updated_at: "2026-11-10T21:52:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120821", "first_seen_at": "2026-11-10T21:46:15+00:00"}, {"source": "analyst", "url": "https://jira.mongodb.org/browse/SERVER-136285", "first_seen_at": "2026-11-10T21:52:36+00:00", "cites": ["https://jira.mongodb.org/browse/SERVER-136285", "http://hol.org/guard/security/cves/CVE-2026-120821-post-authentication-use-after-free-in-mongodb"]}]
exploit_sources: []
---

# MongoDB Server: aggregation use-after-free lets a reader crash the server

Link for people: https://infrastack.ai/live/CVE-2026-120821 (this .md is for agents)

A use-after-free in MongoDB Server 9.0's aggregation framework: cloned expressions ($sortArray, $topN, $top, $bottom, $bottomN) keep a pointer to a collator that can be freed with the original expression context. An authenticated user with read privileges can make the server terminate. Fixed in 9.0.7.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:MongoDB Server affected >= 9.0.0, < 9.0.7 fixed 9.0.7

## How to check

Run mongod --version (or db.version() in mongosh). Exposed if it reports 9.0.0 through 9.0.6. 7.0, 8.0 and 8.3 are not listed: the bug comes from the clone() change in SERVER-119491, added in 9.0. Also check if you run a 9.0 build from a vendor or Atlas-like distribution that you patch yourself.

## Fix

Upgrade MongoDB Server 9.0 to 9.0.7 or later (SERVER-136285 Fix Version 9.0.7).

## Timeline

- 2026-11-10T21:46:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120821
- 2026-11-10T21:52:36+00:00 analyst https://jira.mongodb.org/browse/SERVER-136285 — Fix 9.0.7 read on MongoDB Jira SERVER-136285 (maintainer's own); affected range >=9.0.0 <9.0.7 comes from the HOL mapping plus the ticket's note that the bug arose in 9.0, so not verified. NVD page itself returned nothing. No exploitation or PoC seen; did not check social posts (low volume expected).

## Documents

- [advisory] SERVER-136285 Possibly-dangling collator pointer after ExpressionSortArray clone https://jira.mongodb.org/browse/SERVER-136285
- [mentions] HOL Guard: CVE-2026-120821 http://hol.org/guard/security/cves/CVE-2026-120821-post-authentication-use-after-free-in-mongodb

## From the sources

A use-after-free in the aggregation framework of MongoDB Server can occur when certain expressions are evaluated in an aggregation sub-pipeline. The condition can be caused by an authenticated user with read privileges, and may result in the server terminating unexpectedly.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_