CVE-2026-126837: Attacker able to redirect a client's database traffic to a host they control via special characters in an SRV target, bypassing the SRV parent-domain guard
A validation flaw in the DNS SRV host discovery of the MongoDB Node.js driver may cause the driver to connect to a host outside the expected domain. For a mongodb+srv:// connection string, the driver checks each host name in the DNS SRV response against the domain of the connection string. The driver then builds the connection address from the original name, in which certain characters end the host name early. An unauthenticated party who can forge or change the DNS SRV response may redirect the connection to a host of their choice. TLS does not prevent this, because the driver verifies the server certificate against the redirected host name. This may result in unintended disclosure of application data and authentication credentials, and in altered query results. Applications that use mongodb:// connection strings are not affected.
Event History
Frequently Asked Questions
Which applications are exposed?
Applications using mongodb+srv:// connection strings with the MongoDB Node.js driver are exposed. Applications using mongodb:// connection strings are not affected.
What does an attacker need to exploit this issue?
An unauthenticated attacker must be able to forge or modify the DNS SRV response used for host discovery. They can then use special characters in an SRV target to cause the driver to connect outside the expected domain.
Does TLS prevent the redirection?
No. The driver verifies the server certificate against the redirected host name, so TLS does not prevent the connection from being redirected to an attacker-controlled host.
What could indicate that an application has been affected?
The application may connect to an unintended database host, disclose application data or authentication credentials, or receive altered query results. Review DNS SRV responses and the actual database hosts reached by mongodb+srv:// clients.