VulnSocial

CVE-2026-119179

LOWCVSS 8.3 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A flaw in the connection management layer of the MongoDB Node.js driver can leave a pooled network connection in the pool for reuse while data from an earlier operation is still outstanding on it. In applications that enable an optional client-side operation timeout, an unauthenticated party that can send ordinary requests to the application may cause database replies to be paired with the wrong requests. This may result in unintended disclosure of other users' records, incorrect operation results being returned, and failures of legitimate requests.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-226

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-11-04: 111-04
Full discourse1 post
  • Upwind Security MDR@UpwindMDR

    🚨HIGH - MongoDB Node.js Driver Connection Pool Response Mixup (CVE-2026-119179) MongoDB Node.js driver connection management can return a socket to the pool while prior op data is still pending. With client-side operation timeouts enabled (timeoutMS / client-side timeouts), an unauthenticated requester can desync request/response pairing, causing cross-request response mixups. Impact: data disclosure, incorrect query results, and request failures. 👉Affected: mongodb (MongoDB Node.js driver) versions TBD

    0000013
    380 followersView on X

Explore more

Back to dashboard