UpHeron
All vulnerabilities

Servers and applications

CVE-2026-11933

A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated user with read privileges who is able to run server-side JavaScript (for example, via $where or $function) can cause the server to access memory that has already been freed. This may result in disclosure of information from the mongod…

Severity
High 8.7
Published
12 Jun 2026
Last changed
22 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
5.0.34, 6.0.29, 7.0.37, 8.0.26, 8.2.11, 8.3.4
Sources
NVD

Affected software

SoftwareAffected versions
MongoDBServers and applications · cpe:a:mongodb:mongodb
  • From 8.3.0 before 8.3.4
  • From 8.2.0 before 8.2.11
  • From 8.0.0 before 8.0.26
  • From 7.0.0 before 7.0.37
All 7 release lines
  • From 4.4.0 before 4.4.31
  • From 5.0.0 before 5.0.34
  • From 6.0.0 before 6.0.29
  • From 7.0.0 before 7.0.37
  • From 8.0.0 before 8.0.26
  • From 8.2.0 before 8.2.11
  • From 8.3.0 before 8.3.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-11933
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-11933