---
id: "CVE-2026-126837"
page: "https://infrastack.ai/live/CVE-2026-126837"
kind: "vulnerability"
aliases: ["CVE-2026-126837"]
title: "MongoDB Node.js driver: forged DNS SRV records can redirect connections"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "mongodb", "fixed": ["7.8.0"], "affected": ">= 3.3.3, < 7.8.0", "ecosystem": "npm"}]
ecosystems: []
tags: ["dns", "mongodb", "mongodb+srv", "node.js", "npm", "package"]
not_affected_if: ["mongodb-connection-string-only", "no-srv-lookups"]
published_at: "2026-11-12T17:17:33+00:00"
first_seen_at: "2026-11-12T17:39:38+00:00"
updated_at: "2026-11-12T17:41:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126837", "first_seen_at": "2026-11-12T17:39:38+00:00"}, {"source": "analyst", "url": "https://www.mongodb.com/docs/drivers/node/current/reference/release-notes/", "first_seen_at": "2026-11-12T17:41:22+00:00", "cites": ["https://www.mongodb.com/docs/drivers/node/current/reference/release-notes/", "https://github.com/mongodb/node-mongodb-native/releases/tag/v7.8.0", "https://github.com/mongodb/node-mongodb-native/releases/tag/v6.22.0"]}]
exploit_sources: []
---

# MongoDB Node.js driver: forged DNS SRV records can redirect connections

Link for people: https://infrastack.ai/live/CVE-2026-126837 (this .md is for agents)

The MongoDB Node.js driver checks SRV host names against the connection string domain, but certain characters let a crafted name escape that check, so the driver builds the connection address from the original name and dials the wrong host. An attacker who can forge or change DNS SRV responses can send the app's data, credentials and queries to a server of their choice.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:mongodb affected >= 3.3.3, < 7.8.0 fixed 7.8.0

## How to check

- Run `npm ls mongodb` (also check lock files and transitive copies, e.g. via mongoose). Versions 3.3.3 through 7.7.x are affected; 7.8.0 is fixed.
- Search for `mongodb+srv://` in code, env vars and config. Apps using only `mongodb://` are not affected.
- Only exploitable by someone who can forge or alter DNS SRV responses for your resolver path.

## Fix

Upgrade the mongodb npm package to 7.8.0 or later. No fix for the 6.x line is listed: 6.22.0 release notes do not mention the SRV issue. Optionally set srvAllowedHostsSuffix (new in 7.8.0) to pin the allowed host-name suffix.

## Timeline

- 2026-11-12T17:39:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126837
- 2026-11-12T17:41:22+00:00 analyst https://www.mongodb.com/docs/drivers/node/current/reference/release-notes/ — Fixed in mongodb npm driver 7.8.0 (released 2026-10-30); affected 3.3.3 through 7.7 per the GitHub release notes and MongoDB docs. 6.22.0 (2026-11-02) lists no SRV fix, so 6.x users have no stated fixed version. NVD page gave no text; CVE id confirmed in the v7.8.0 release notes. Exploitation and PoC: none seen, not searched on social.

## Documents

- [advisory] MongoDB Node.js driver release notes (What's New in 7.8) https://www.mongodb.com/docs/drivers/node/current/reference/release-notes/
- [fix] mongodb Node.js driver v7.8.0 release notes https://github.com/mongodb/node-mongodb-native/releases/tag/v7.8.0
- [mentions] mongodb Node.js driver v6.22.0 release notes (no SRV fix listed) https://github.com/mongodb/node-mongodb-native/releases/tag/v6.22.0

## From the sources

A validation flaw in the DNS SRV host discovery of the MongoDB Node.js driver may cause the driver to connect to a host outside the expected domain. For a mongodb+srv:// connection string, the driver checks each host name in the DNS SRV response against the domain of the connection string. The driver then builds the connection address from the original name, in which certain characters end the host name early. An unauthenticated party who can forge or change the DNS SRV response may redirect the connection to a host of their choice. TLS does not prevent this, because the driver verifies the server certificate against the redirected host name. This may result in unintended disclosure of application data and authentication credentials, and in altered query results. Applications that use mongodb:// connection strings are not affected.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_