CVE-2026-11933: Post-authentication use-after-free in server-side JavaScript BSON-to-array conversion
A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated user with read privileges who is able to run server-side JavaScript (for example, via $where or $function) can cause the server to access memory that has already been freed. This may result in disclosure of information from the mongod process memory or a denial of service through a server crash.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11933?
CVE-2026-11933 has a severity rating of high, with a score of 8.7.
How do I fix CVE-2026-11933?
To mitigate CVE-2026-11933, it is recommended to update MongoDB Server to the latest version following the vendor's guidance.
What type of vulnerability is CVE-2026-11933?
CVE-2026-11933 is identified as a use-after-free vulnerability in the server-side JavaScript engine.
Who is affected by CVE-2026-11933?
Authenticated users with read privileges that can execute server-side JavaScript can exploit CVE-2026-11933.
What impact does CVE-2026-11933 have on MongoDB Server?
CVE-2026-11933 can lead to unauthorized access to memory, potentially allowing an attacker to read sensitive information.