CVE-2026-82052: $regexFindAll may crash mongod server when byte-matching multi-byte UTF-8 chars
The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server (mongod). Under certain specific conditions the regex match can start in the middle of a multi-code-unit character, triggering an assertion during query execution.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
MongoDB deployments are exposed if authenticated users can run aggregation pipeline stages. The described impact is a crash of the mongod server, resulting in an availability risk.
What does an attacker need to trigger the crash?
An attacker needs valid authentication and permission to run aggregation pipeline stages. Exploitation also depends on constructing a $regexFindAll match that begins in the middle of a multi-code-unit UTF-8 character under the specific conditions described.
Is a default MongoDB deployment known to be affected?
The available information does not state whether default configurations permit the required aggregation activity. Exposure depends on whether authenticated users have the ability to run aggregation pipeline stages.
What can be done if patching is not immediately possible?
Restrict aggregation pipeline execution for authenticated users who do not require it, particularly access to queries using $regexFindAll. This reduces the set of users able to submit the input needed to trigger the assertion.