A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated user with read privileges who is able to run server-side JavaScript (for example, via $where or $function) can cause the server to access memory that has already been freed. This may result in disclosure of information from the mongod process memory or a denial of service through a server crash.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Mongodb | — | Upgrade to the latest version of MongoDBUpgrade MongoDB to version 5.0.34Upgrade MongoDB to version 6.0.29Upgrade MongoDB to version 8.0.26Upgrade MongoDB to version 4.4.31Upgrade MongoDB to version 8.3.4Upgrade MongoDB to version 8.2.11Upgrade MongoDB to version 7.0.37 | Jul 1, 2026 | Jun 12, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub