CVE-2026-11933
MongoDB Server: use after free in server-side JavaScript BSON-to-array conversion
Technology
MongoDB
CVSS Score
8.8 / 10.0
Affected Versions
8.3.3 and earlier; 8.2.10 and earlier; 8.0.25 and earlier; 7.0.36 and earlier; 6.0.28 and earlier; 5.0.33 and earlier; 4.4.30 and earlier
Upstream Fix
8.3.4; 8.2.12; 8.0.26; 7.0.37; 6.0.29; 5.0.34; 4.4.31
Published
June 12, 2026
OSSeva Coverage
Fixed upstream
Description
A use-after-free in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays lets an authenticated user with read privileges who can run server-side JavaScript, for example through $where or $function, make the server access freed memory. This can disclose mongod process memory or crash the server. Tracked as SERVER-128125.
Is your MongoDB deployment affected?
If you're running 8.3.3 and earlier; 8.2.10 and earlier; 8.0.25 and earlier; 7.0.36 and earlier; 6.0.28 and earlier; 5.0.33 and earlier; 4.4.30 and earlier, you need this patch. Book a discovery call to get covered.