{"id":"CVE-2026-126837","kind":"vulnerability","aliases":["CVE-2026-126837"],"related":[],"title":"MongoDB Node.js driver: forged DNS SRV records can redirect connections","description":"A validation flaw in the DNS SRV host discovery of the MongoDB Node.js driver may cause the driver to connect to a host outside the expected domain. For a mongodb+srv:// connection string, the driver checks each host name in the DNS SRV response against the domain of the connection string. The driver then builds the connection address from the original name, in which certain characters end the host name early. An unauthenticated party who can forge or change the DNS SRV response may redirect the connection to a host of their choice. TLS does not prevent this, because the driver verifies the server certificate against the redirected host name. This may result in unintended disclosure of application data and authentication credentials, and in altered query results. Applications that use mongodb:// connection strings are not affected.","summary":"The MongoDB Node.js driver checks SRV host names against the connection string domain, but certain characters let a crafted name escape that check, so the driver builds the connection address from the original name and dials the wrong host. An attacker who can forge or change DNS SRV responses can send the app's data, credentials and queries to a server of their choice.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mongodb","fixed":["7.8.0"],"affected":">= 3.3.3, < 7.8.0","ecosystem":"npm"}],"ecosystems":[],"tags":["dns","mongodb","mongodb+srv","node.js","npm","package"],"not_affected_if":["mongodb-connection-string-only","no-srv-lookups"],"how_to_check":"- Run `npm ls mongodb` (also check lock files and transitive copies, e.g. via mongoose). Versions 3.3.3 through 7.7.x are affected; 7.8.0 is fixed.\n- Search for `mongodb+srv://` in code, env vars and config. Apps using only `mongodb://` are not affected.\n- Only exploitable by someone who can forge or alter DNS SRV responses for your resolver path.","fix":"Upgrade the mongodb npm package to 7.8.0 or later. No fix for the 6.x line is listed: 6.22.0 release notes do not mention the SRV issue. Optionally set srvAllowedHostsSuffix (new in 7.8.0) to pin the allowed host-name suffix.","status":"open","published_at":"2026-11-12T17:17:33+00:00","first_seen_at":"2026-11-12T17:39:38+00:00","triaged_at":"2026-11-12T17:39:49+00:00","updated_at":"2026-11-12T17:41:22+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-12T17:39:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"MongoDB Node.js driver: forged DNS SRV records can redirect connections","impact":"high","summary":"The MongoDB Node.js driver checks SRV host names against the connection string domain, but certain characters let a crafted name escape that check, so the driver builds the connection address from the original name and dials the wrong host. An attacker who can forge or change DNS SRV responses can send the app's data, credentials and queries to a server of their choice.","audience":"developers","category":"package","nicknames":[],"who_cares":["mongodb","node.js","npm","mongodb+srv"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Credentials and application data sent to an attacker-chosen host","analyst_note":"Find the fixed driver version and the affected range in the NVD entry or MongoDB advisory; sources given here state no fix.","how_to_check":"- Check the installed driver version with `npm ls mongodb`\n- Search the codebase for connection strings starting with `mongodb+srv://`; applications using only `mongodb://` are not affected\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["mongodb-connection-string-only","no-srv-lookups"],"who_is_affected":"Applications using the MongoDB Node.js driver with `mongodb+srv://` connection strings, which resolve hosts through DNS SRV lookups. Applications that use only `mongodb://` connection strings are stated not to be affected. Exposure also depends on whether an attacker can forge or alter DNS responses on the path the application uses.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000773,"input_tokens":4695,"output_tokens":608,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the fixed driver version and the affected range in the NVD entry or MongoDB advisory; sources given here state no fix.","search":"'-126837':13A,16A '-2026':12A,15A 'address':54B,145C 'affect':222C 'alter':212C 'app':77B 'applic':205C,215C 'attack':65B 'authent':208C 'build':51B,142C 'caus':104C 'certain':39B,152C 'certif':192C 'chang':70B,166C 'charact':40B,153C 'check':29B,47B,123C 'choic':88B,180C 'connect':10A,35B,53B,108C,119C,137C,144C,174C,218C 'craft':43B 'credenti':80B,209C 'cve':11A,14A 'data':79B,206C 'dial':60B 'disclosur':203C 'discoveri':97C 'dns':5A,18B,71B,94C,129C,168C 'domain':37B,115C,134C 'driver':3A,28B,50B,102C,106C,122C,140C,188C 'earli':158C 'end':154C 'escap':45B 'expect':114C 'flaw':91C 'forg':4A,68B,164C 'host':31B,63B,96C,111C,125C,156C,177C,196C 'let':41B 'may':103C,171C,199C 'mongodb':1A,17A,19B,20B,26B,100C,118C 'name':32B,44B,58B,126C,149C,157C,197C 'node.js':2A,22B,27B,101C 'npm':23B 'origin':57B,148C 'outsid':112C 'packag':24B 'parti':161C 'prevent':184C 'queri':82B,213C 'record':7A 'redirect':9A,172C,195C 'respons':73B,131C,170C 'result':200C,214C 'send':75B 'server':85B,191C 'srv':6A,21B,30B,72B,95C,130C,169C 'string':36B,120C,138C,219C 'tls':181C 'unauthent':160C 'unintend':202C 'use':217C 'valid':90C 'verifi':189C 'wrong':62B","nicknames":[],"mitigations":[],"who_affected":"Applications using the MongoDB Node.js driver with `mongodb+srv://` connection strings, which resolve hosts through DNS SRV lookups. Applications that use only `mongodb://` connection strings are stated not to be affected. Exposure also depends on whether an attacker can forge or alter DNS responses on the path the application uses.","tier":"B","verified":{"fix":{"at":"2026-11-12T17:41:22Z","by":"analyst","doc":"https://www.mongodb.com/docs/drivers/node/current/reference/release-notes/","run_id":3755},"products":{"at":"2026-11-12T17:41:22Z","by":"analyst","doc":"https://www.mongodb.com/docs/drivers/node/current/reference/release-notes/","run_id":3755},"how_to_check":{"at":"2026-11-12T17:41:22Z","by":"analyst","doc":"https://www.mongodb.com/docs/drivers/node/current/reference/release-notes/","run_id":3755},"who_affected":{"at":"2026-11-12T17:41:22Z","by":"analyst","doc":"https://www.mongodb.com/docs/drivers/node/current/reference/release-notes/","run_id":3755}},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["mongodb"],"ptokens":["mongodb"],"labels":["critical","dns","mongodb","mongodbsrv","nodejs","npm","package"],"campaign_type":null,"search_a":"'-126837':13A,16A '-2026':12A,15A 'connect':10A 'cve':11A,14A 'dns':5A 'driver':3A 'forg':4A 'mongodb':1A,17A 'node.js':2A 'record':7A 'redirect':9A 'srv':6A","search_b":"'address':54B 'app':77B 'attack':65B 'build':51B 'certain':39B 'chang':70B 'charact':40B 'check':29B,47B 'choic':88B 'connect':35B,53B 'craft':43B 'credenti':80B 'data':79B 'dial':60B 'dns':18B,71B 'domain':37B 'driver':28B,50B 'escap':45B 'forg':68B 'host':31B,63B 'let':41B 'mongodb':19B,20B,26B 'name':32B,44B,58B 'node.js':22B,27B 'npm':23B 'origin':57B 'packag':24B 'queri':82B 'respons':73B 'send':75B 'server':85B 'srv':21B,30B,72B 'string':36B 'wrong':62B","search_c":"'address':145C 'affect':222C 'alter':212C 'applic':205C,215C 'authent':208C 'build':142C 'caus':104C 'certain':152C 'certif':192C 'chang':166C 'charact':153C 'check':123C 'choic':180C 'connect':108C,119C,137C,144C,174C,218C 'credenti':209C 'data':206C 'disclosur':203C 'discoveri':97C 'dns':94C,129C,168C 'domain':115C,134C 'driver':102C,106C,122C,140C,188C 'earli':158C 'end':154C 'expect':114C 'flaw':91C 'forg':164C 'host':96C,111C,125C,156C,177C,196C 'may':103C,171C,199C 'mongodb':100C,118C 'name':126C,149C,157C,197C 'node.js':101C 'origin':148C 'outsid':112C 'parti':161C 'prevent':184C 'queri':213C 'redirect':172C,195C 'respons':131C,170C 'result':200C,214C 'server':191C 'srv':95C,130C,169C 'string':120C,138C,219C 'tls':181C 'unauthent':160C 'unintend':202C 'use':217C 'valid':90C 'verifi':189C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T17:17:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126837","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126837","severity":null,"published_at":"2026-11-12T17:17:33+00:00","modified_at":"2026-11-12T17:17:33+00:00","first_seen_at":"2026-11-12T17:39:38+00:00","fetched_at":"2026-11-12T17:39:38+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126837:3755","url":"https://github.com/mongodb/node-mongodb-native/releases/tag/v7.8.0","severity":null,"published_at":"2026-11-12T17:41:22+00:00","modified_at":"2026-11-12T17:41:22+00:00","first_seen_at":"2026-11-12T17:41:22+00:00","fetched_at":"2026-11-12T17:41:22+00:00","note":"Fixed in mongodb npm driver 7.8.0 (released 2026-10-30); affected 3.3.3 through 7.7 per the GitHub release notes and MongoDB docs. 6.22.0 (2026-11-02) lists no SRV fix, so 6.x users have no stated fixed version. NVD page gave no text; CVE id confirmed in the v7.8.0 release notes. Exploitation and PoC: none seen, not searched on social.","cites":["https://github.com/mongodb/node-mongodb-native/releases/tag/v7.8.0","https://www.mongodb.com/docs/drivers/node/current/reference/release-notes/","https://github.com/mongodb/node-mongodb-native/releases/tag/v6.22.0"]}],"documents":[{"id":137011,"url":"https://github.com/mongodb/node-mongodb-native/releases/tag/v7.8.0","title":"mongodb Node.js driver v7.8.0 release notes","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":137012,"url":"https://www.mongodb.com/docs/drivers/node/current/reference/release-notes/","title":"MongoDB Node.js driver release notes (What's New in 7.8)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":137013,"url":"https://github.com/mongodb/node-mongodb-native/releases/tag/v6.22.0","title":"mongodb Node.js driver v6.22.0 release notes (no SRV fix listed)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}