MongoDB Node.js Driver EUVD-2026-115819

Exploitation requires the application to have enabled the optional client-side operation timeout feature of the MongoDB Node.js driver (e.g. a configured operation timeout); the description states the response-mispairing occurs specifically in applications that enable this timeout, so deployments without it are not affected. Given the timeout, an unauthenticated party that can send ordinary requests to the application can trigger the condition - no authentication (PR:N) or user interaction (UI:N) is needed. Limiting factors: the flaw depends on this non-default timeout configuration and on an earlier operation actually timing out and leaving outstanding data on a pooled connection (reflected as AT:P / attack requirements present), so exploitation is opportunistic and timing-dependent rather than deterministic on default configurations.

Signals are mixed and point to a genuine but conditional priority rather than an emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L) yields 8.3 (High): network-reachable, no authentication (PR:N), no user interaction, high confidentiality impact from cross-user data disclosure, with lower integrity/availability impact (wrong results and failed requests). Critically, the vector sets AT:P (attack requirements present), which aligns with the description's gating condition - the flaw is only reachable when the application enables the optional client-side operation timeout - so this is not an unconditional remote info-leak against default settings. No EPSS score, no CISA KEV entry, and no exploit/PoC reference are present in the input, so exploitation likelihood cannot be quantified from the data. The vuln.today Decision label is 'this_week' (not act_now/emergency), consistent with a high-severity, vendor-reported issue lacking evidence of active exploitation. Net: a real priority to patch this week because the confidentiality impact (other users' records) is serious and no authentication is needed, but the config-dependent trigger and absence of exploitation signals argue against treating it as a drop-everything emergency. Missing data to note explicitly: no EPSS, no KEV status, and no fixed-version information are included in the provided sources.

An application uses the MongoDB Node.js driver with the optional client-side operation timeout enabled. An unauthenticated user sends ordinary requests to the application; when an earlier operation times out, its connection is returned to the pool while a reply is still outstanding, so a later request on that reused connection is paired with the wrong database reply and receives another user's records or an incorrect result. No public exploit was identified at time of analysis.