Information disclosure via DBPointer handling in MongoDB server-side JavaScript (CVE-2026-13066)

Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can cause internal process memory contents to be included in data returned to the client. This constitutes an unintended information disclosure affecting deployments that use server-side JavaScript. Affected versions: - 6.0.0 - 7.0.0 - 8.0.0 - 8.1.0 - 8.2.0 - 8.3.0 We recommend updating to: 7.0.39, 8.0.28, 8.2.12, 8.3.7, 9.0.0-rc1, 9.1.0-rc0. CVSS 7.1 · our assessment: this_week Reference: https://jira.mongodb.org/browse/SERVER-127694 Details: https://vuln.today/cve/CVE-2026-13066