Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-120821 EUVD-2026-122837GHSA-75j2-rc7h-2rxp

Post-authentication use-after-free in MongoDB Server aggregation sub-pipelines

Published Nov 10, 2026 · Updated Nov 13, 2026 · Assigned by mongodb

Description

A use-after-free in the aggregation framework of MongoDB Server can occur when certain expressions are evaluated in an aggregation sub-pipeline. The condition can be caused by an authenticated user with read privileges, and may result in the server terminating unexpectedly.

Affected products

VendorProductAffectedFixed
MongoDB MongoDB Server 9.0.0 – < 9.0.7 9.0.7

Advisories 1

References