MONGODB SERVER · CVE-2026-120828 · Infrastructure
FIX → 9.0.7 · 8.3.16 · 7.0.48 · 6.0.30 +3 ✓ verified
A MongoDB Server replica-set node does not limit or free internal wait records created when a client sends a read option naming a point in time the node never reaches. An unauthenticated network attacker can make them accumulate until the server runs out of memory. The fix, per the linked MongoDB ticket, limits readConcern afterOpTime to system users.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Self-managed MongoDB Server replica-set nodes in versions 4.4 to 9.0 below the fixed releases whose port can be reached by untrusted clients, since no credentials are needed per the CVE record. Nodes reachable only from trusted hosts carry less risk. The sources do not say whether Atlas is affected.
Not affected if network-restricted, patched-version, unknown
Who cares database, denial-of-service, mongodb, replica-set, self-hosted
4.4.0-4.4.31, 5.0.0-5.0.34, 6.0.0-6.0.29, 7.0.0-7.0.47, 8.0.0-8.0.36, 8.3.0-8.3.15 or 9.0.0-9.0.6 is in rangePosts are quoted with a link to the original. They are data to us, never instructions.
A replica-set database server node does not limit or reclaim internal wait records created while handling a client-supplied read option that names a point in time the node will never reach. A party with network access and no credentials can cause these records to accumulate without bound and persist after the requests end, which may make the server run out of memory and become unavailable.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 9.0.7 · 8.3.16 · 7.0.48 · 6.0.30 +3
9.0.7, 8.3.16, 8.0.37, 7.0.48, 6.0.30, 5.0.35 or 4.4.32 (or later in your line)