CVE-2026-25610: Invalid $geoNear index hint may cause server crash
Published Feb 10, 2026
·Updated
An authorized user may trigger a server crash by running a $geoNear pipeline with certain invalid index hints.
Affected Software
2 affected components
MongoDB MongoDB>=7.0.0<7.0.29
MongoDB MongoDB>=8.0.0<8.0.13
Event History
Feb 10, 2026
CVE Published
via MITRE·06:30 PM
Data Sourced
via MITRE·06:30 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:16 PM
DescriptionSeverityWeaknessAffected Software
Jan 23, 58126
Event
via FIRST·09:48 PM
Frequently Asked Questions
1
What is the severity of CVE-2026-25610?
CVE-2026-25610 has been classified with high severity as it can lead to a server crash when certain invalid index hints are used.
2
How do I fix CVE-2026-25610?
To fix CVE-2026-25610, ensure that all MongoDB queries using the $geoNear pipeline do not include invalid index hints.
3
Which MongoDB versions are affected by CVE-2026-25610?
CVE-2026-25610 affects MongoDB versions from 7.0.0 to 7.0.29 and from 8.0.0 to 8.0.13.
4
What could happen if I ignore CVE-2026-25610?
Ignoring CVE-2026-25610 may result in unauthorized users being able to crash your MongoDB server, leading to downtime and potential data loss.
5
Is there a workaround for CVE-2026-25610?
Currently, the best workaround for CVE-2026-25610 is to avoid using invalid index hints in your $geoNear queries.