CVE-2026-8336: Post-authentication use-after-free error in $_internalJsEmit and mapreduce commands
After invoking $internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subsequently crash mongod when the server-side JavaScript engine (through $where, $function, mapreduce reduce stage, etc.) is used also in a specific way, resulting in a post-authentication denial-of-service.
This issue impacts MongoDB Server v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MongoDB Serverto a version that resolves this vulnerability.Fixed in 8.2.9 - Upgrade
Upgrade
MongoDB Serverto a version that resolves this vulnerability.Fixed in 8.3.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8336?
CVE-2026-8336 has a severity rating that indicates it poses a significant risk due to a post-authentication use-after-free vulnerability that could crash the MongoDB server.
How do I fix CVE-2026-8336?
To fix CVE-2026-8336, upgrade to MongoDB server versions 7.0.34, 8.0.23, 8.2.9, or 8.3.2 or later, which contain the necessary patches.
Who is affected by CVE-2026-8336?
CVE-2026-8336 affects authenticated users of MongoDB Server versions prior to 7.0.34, 8.0.23, 8.2.9, and 8.3.2.
What impact does CVE-2026-8336 have on MongoDB Server?
The impact of CVE-2026-8336 is that it can allow authenticated users to crash the MongoDB server, potentially leading to service disruption.
Is there any workaround for CVE-2026-8336?
There are no recommended workarounds for CVE-2026-8336; the best mitigation is to apply updates to the MongoDB server as specified.