Skip to content
OpenAdvisories
High · 7.5 CVE-2026-8336 EUVD-2026-29893GHSA-5f8r-h2c3-xvqc

Post-authentication use-after-free error in $_internalJsEmit and mapreduce commands

Published May 13, 2026 · Updated May 15, 2026 · Assigned by mongodb

Description

After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subsequently crash mongod when the server-side JavaScript engine (through $where, $function, mapreduce reduce stage, etc.) is used also in a specific way, resulting in a post-authentication denial-of-service.

This issue impacts MongoDB Server v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

Affected products

VendorProductAffectedFixed
MongoDB MongoDB Server 8.2 – < 8.2.9, 8.3 – < 8.3.2 8.2.9

Advisories 1

References