CVE-2026-11933: Use-After-Free Vulnerability in MongoDB Server
High CVSS (8.8) vulnerability; prioritize internet-facing assets.
| Field | Value |
|---|---|
| CVE ID | CVE-2026-11933 |
| CVSS score | 8.8 (High) |
| Attack vector | Authenticated access to MongoDB Server with ability to execute server-side JavaScript |
| Auth required | Yes |
| Patch status | Vendor issue exists, but exact fixed version was not verifiable from accessible primary-source material in this research pass |
TL;DR - High severity use-after-free in MongoDB Server’s server-side JavaScript engine. - Affects authenticated users with read privileges who can use
$whereor$function. - No confirmed in-the-wild exploitation or reliable public PoC, but defenders should treat reachable instances as urgent.
What this vulnerability is and why it matters
CVE-2026-11933 is a use-after-free vulnerability in MongoDB Server. According to the NVD description, the flaw sits in the server-side JavaScript engine when MongoDB converts BSON documents into JavaScript arrays. If triggered, mongod can access memory that has already been freed. NVD states the likely security outcomes are information disclosure from mongod process memory or denial of service through a server crash.
This is not a pre-auth remote code execution issue based on the currently available evidence. The attack requires an authenticated user, read privileges, and the ability to run server-side JavaScript. NVD explicitly cites $where and $function as examples of reachable paths. That narrows exposure compared with unauthenticated flaws, but it still matters in shared environments, analytics-heavy deployments, and any organization that allows lower-trust users or application roles to execute expressive queries against MongoDB.
Quick risk assessment for defenders
For most defenders, the key question is not just severity but reachability. A CVSS 8.8 score is high, but the practical risk depends on whether your environment allows server-side JavaScript execution and whether accounts with read access can submit or influence query expressions. If your applications never use $where or $function, and your access model is tightly controlled, your immediate exposure may be lower than the base score suggests.
That said, the impact is still meaningful because this is a memory-safety flaw inside a core database process. Even when exploitation does not lead to code execution, memory disclosure can expose sensitive in-process data, and a server crash can disrupt production availability. If you run MongoDB in a multitenant or analyst-facing model, or if application users can influence query logic, treat this as a priority review item.
Affected products and version status
The confirmed affected product is MongoDB Server. The vulnerable component is the server-side JavaScript engine, specifically the handling of BSON-to-JavaScript-array conversion. That part is directly supported by the NVD description and the vendor issue reference tied to SERVER-128125.
However, the exact affected version ranges and the specific fixed version number were not confirmed from accessible primary-source advisory text in this research pass. In other words:
| Version data point | Status |
|---|---|
| Affected product | Confirmed: MongoDB Server |
| Affected versions | Unknown from accessible primary sources reviewed |
| Fixed version | Unknown from accessible primary sources reviewed |
| Vendor-tracked issue | Confirmed: SERVER-128125 |
Because the version matrix is unknown, defenders should avoid guessing based on unrelated release notes or branch patterns. In the absence of a verified vendor advisory, the safe assumption is that any supported MongoDB Server branch using server-side JavaScript features may require review until MongoDB release notes or the referenced Jira issue explicitly tie a fix to a version. If you are responsible for production clusters, confirm with MongoDB support channels or release documentation before closing the ticket.
Exploitation status and PoC availability
At the time of writing, exploitation in the wild is not confirmed. The CVE is not listed in CISA’s Known Exploited Vulnerabilities catalog, and the research materials available for this article did not provide a primary-source statement from MongoDB or CISA that active exploitation is occurring.
Likewise, no reliable public PoC is confirmed from clearly attributable primary or trustworthy secondary sources reviewed in this pass. That does not make the bug low risk. It means defenders should distinguish between known exploitation and exploitable conditions. When a memory-safety issue is reachable by authenticated users through common query features, attackers with internal access, compromised credentials, or application-layer footholds may still be able to weaponize it before public exploit artifacts appear.
Exposure conditions: who should worry most
The environments most at risk are those where server-side JavaScript is actually used or can be invoked by authenticated users. NVD explicitly mentions $where and $function, which means this is not just a theoretical engine bug. If your application stack or data team uses those features for filtering, transformation, or custom logic, your reachable attack surface is materially higher.
Priority review should go to the following cases:
- Shared or multitenant MongoDB deployments
- Internal portals where analysts can submit custom queries
- Applications that accept user-influenced filters and translate them into MongoDB expressions
- Legacy codebases still using
$where - Any role with read privileges that can also run JavaScript-backed query logic
Even if your security model assumes trusted authenticated users, remember that many real intrusions begin with stolen credentials, abused service accounts, or lateral movement. An “authenticated” database flaw can become very relevant once an attacker lands inside the environment.
Bottom line
CVE-2026-11933 is a high-severity MongoDB Server vulnerability that can be triggered by an authenticated user with read privileges who can execute server-side JavaScript, including via $where or $function. The confirmed impacts are memory disclosure from the mongod process and denial of service through a crash.
What defenders know today is enough to act: MongoDB Server is affected, exploitation in the wild is not confirmed, and a reliable public PoC is not confirmed. What defenders do not yet have from the accessible source set is an authoritative affected-version range or fixed version number. Until MongoDB publishes or confirms that matrix, assume reachable deployments using server-side JavaScript need immediate review, mitigation, and upgrade planning.
For further information on vulnerabilities, you can check the CVE-2026-11437 and learn about securing IoT devices in our FAQ on securing IoT devices.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.
Detection and hunting guidance
Detection is harder here than with a network-delivered exploit because the trigger condition is query behavior and process instability, not a single obvious inbound exploit string. Start by identifying whether your environment uses $where, $function, or other JavaScript-backed MongoDB features at all. If your baseline is zero, any appearance of those operators deserves review.
Next, correlate application query activity with mongod crashes, segmentation faults, unexpected restarts, or memory-related instability. The NVD description indicates the bug can lead to denial of service through a crash, so process termination around JavaScript-executing queries is a practical hunting lead. If you do not have query audit visibility enabled, that gap itself is important and should be fixed.
Technical Notes
Potential log and telemetry indicators to review:
$where
$function
JavaScript execution
segmentation fault
Fatal assertion
Caught signal
Example Linux log review for mongod crashes:
journalctl -u mongod --since "7 days ago" | egrep -i 'signal|segmentation fault|fatal|assert|crash'
Example audit or application log grep for JavaScript-backed query operators:
grep -R --line-number -E '\$where|\$function' /var/log /srv/apps 2>/dev/null
If MongoDB audit logs are enabled and shipped to a SIEM, use a simple query to hunt for risky operator use:
(".$where" OR "\"$where\"" OR "\"$function\"" OR ".$function")
AND ("find" OR "aggregate" OR "command")
Network-side detection is limited because MongoDB traffic is often application-specific and may be encrypted. Still, if you inspect plaintext traffic in a lab or controlled internal environment, look for BSON or JSON payload content referencing $where or $function from lower-trust clients that do not normally use those operators.
Mitigation and patching
The best long-term mitigation is to upgrade to a vendor-fixed MongoDB Server release. But the exact fixed version number is unknown from the accessible primary-source material reviewed here, so it would be irresponsible to claim a specific target version. Your immediate action should be to identify the exact branch you are running and cross-check MongoDB release notes or support guidance for a fix tied to SERVER-128125 or CVE-2026-11933.
While awaiting version confirmation, reduce exploitability by minimizing or eliminating server-side JavaScript execution wherever possible. Review code paths that use $where and $function, especially where user input can shape those expressions. Restrict accounts with read privileges from invoking JavaScript-backed features unless there is a documented business need. In some environments, rewriting $where logic into standard query operators will both improve performance and reduce risk.
Technical Notes
Check your installed MongoDB version:
mongod --version
If you manage MongoDB through Debian or Ubuntu packages, the upgrade flow after confirming the fixed build would typically be:
sudo apt update
apt-cache policy mongodb-org
sudo apt install --only-upgrade mongodb-org
For RHEL, CentOS, Rocky, or AlmaLinux environments:
sudo dnf check-update mongodb-org
sudo dnf upgrade mongodb-org
For environments where an immediate upgrade is not yet scheduled, hunt and refactor application usage of risky operators. Example code search:
grep -R --line-number -E '\$where|\$function' /srv/apps /opt/services 2>/dev/null
If you find $where or $function in production code, replace them with standard MongoDB query operators where possible. If a workaround is needed before patching, the operational goal is clear even if a single vendor-issued toggle was not confirmed in the research: prevent lower-trust authenticated users from executing server-side JavaScript paths.
Operational response checklist
Start by inventorying every MongoDB Server deployment, including self-managed clusters, embedded application instances, development environments, and analytics nodes. Then determine which applications or users can execute $where or $function. This step often reveals undocumented query behavior or legacy code that was never reviewed from a security perspective.
From there, put short-term controls in place: restrict access, monitor mongod stability, and escalate vendor version verification. If you run a regulated environment or host sensitive data, assume memory disclosure could expose in-process secrets or document fragments and prioritize remediation accordingly. Even without confirmed exploitation, a high-severity authenticated database flaw deserves change-window attention.
References
Primary sources used for this article:
- NVD CVE record: https://nvd.nist.gov/vuln/detail/CVE-2026-11933
- MongoDB Jira issue referenced by NVD: https://jira.mongodb.org/browse/SERVER-128125
- CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- MongoDB server-side JavaScript documentation: https://www.mongodb.com/docs/v7.0/core/server-side-javascript/