Which versions of MongoDB Server are affected by CVE-2026-11933?

MongoDB Server is vulnerable to memory disclosure and denial-of-service attacks through authenticated users exploiting the JavaScript query engine ($where and $function operators).. A patch is available.

How to fix or mitigate CVE-2026-11933?

Within 24 hours: Audit MongoDB user accounts and document which users have JavaScript execution privileges ($where and $function operators). Within 7 days: Disable $where and $function operators at the application layer if functionality permits; revoke JavaScript execution rights for non-administrative accounts; implement query validation to block dangerous operators. Within 30 days: Monitor MongoDB vendor advisories for patch release; establish timeline for patching or upgrading affected MongoDB Server instances once patch becomes available.

MongoDB Server CVE-2026-11933

Q: What is the CVSS score of CVE-2026-11933?

CVE-2026-11933 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-36373 HIGH

Out-of-bounds Write (CWE-787)

2026-06-12 mongodb

GHSA-x5xf-rwjm-436w

Buffer Overflow Denial Of Service Memory Corruption MongoDB

8.7

CVSS 4.0 · Vendor: mongodb

Severity by source

Vendor (mongodb) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network-reachable mongod, low-complexity query, authenticated read role required (PR:L); high confidentiality from memory disclosure and high availability from crash, but no integrity impact described.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mongodb).

CVSS VectorVendor: mongodb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 12, 2026 - 02:27 vuln.today

CVSS changed

Jun 12, 2026 - 02:22 NVD

8.8 (HIGH) 8.7 (HIGH)

DescriptionCVE.org

A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated user with read privileges who is able to run server-side JavaScript (for example, via $where or $function) can cause the server to access memory that has already been freed. This may result in disclosure of information from the mongod process memory or a denial of service through a server crash.

AnalysisAI

Memory disclosure and denial of service in MongoDB Server's server-side JavaScript engine allow an authenticated user with read privileges and JavaScript execution rights to read freed heap memory or crash the mongod process. The flaw is triggered during BSON-to-JavaScript array conversion when operators such as $where or $function are evaluated. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was self-reported by MongoDB.

Technical ContextAI

MongoDB embeds a server-side JavaScript engine (historically SpiderMonkey) that converts BSON documents - MongoDB's binary serialization format - into native JavaScript values so query predicates like $where and aggregation $function can operate on them. The bug lives in the BSON-to-JS array conversion path, where an object reference is freed but subsequently dereferenced. NVD assigns CWE-787 (out-of-bounds write), but the description explicitly characterizes the root cause as a use-after-free (CWE-416); the practical effect is the same class of C/C++ memory-safety bug in the conversion routine, leaking adjacent heap contents or causing a fatal access violation in mongod.

RemediationAI

No vendor-released patch identified at time of analysis in the provided data - track https://jira.mongodb.org/browse/SERVER-128125 for the fixed build numbers across the 6.0, 7.0, and 8.x release lines and upgrade as soon as MongoDB publishes them. As a compensating control, disable server-side JavaScript execution by starting mongod with security.javascriptEnabled: false (or --noscripting), which blocks $where, $function, $accumulator and mapReduce JavaScript and prevents reaching the vulnerable conversion path; the trade-off is that applications relying on those operators will break and must be rewritten to use aggregation pipeline equivalents. Where JavaScript cannot be disabled, revoke the find/read role from accounts that do not strictly need it and audit roles granting JavaScript-capable operators, since PR:L means any authenticated reader who can issue $where is sufficient to trigger the bug.