CVE-2026-11933Patch(mongodb / mongodb)

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch mongodb mongodb systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated user with read privileges who is able to run server-side JavaScript (for example, via $where or $function) can cause the server to access memory that has already been freed. This may result in disclosure of information from the mongod process memory or a denial of service through a server crash.

mongodb CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

https://jira.mongodb.org/browse/SERVER-128125

Weakness type (CWE)

CWE-787CWE-416

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

mongodb

Threat summary

Patch or workaround signal is available
7 mentions across 6 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 5 signals
Technical details provided in 5 signals
General: 2 classified signals
Disclosure: 1 classified signal
Peaked 4d ago at 2 mentions (2026-06-17); latest day: 1
7 total mentions across 6 days

Affected systems

Vendors

mongodb

Products

mongodb

Deep dive

Activity timeline7 mentions / 6d

Signal classification3 categories

Patch

457.1%

General

228.6%

Disclosure

114.3%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-12	1	Disclosure1
2026-06-17	2	Patch2
2026-06-24	1	General1
2026-06-25	1	General1
2026-06-26	1	Patch1
2026-06-30	1	Patch1

Full discourse7 posts

Daily CyberSecurity@the_yellow_fall132d
Patch
A MongoDB Server vulnerability chain, including a use-after-free flaw (CVE-2026-11933), lets attackers crash servers or leak memory. Patch now. #MongoDB #NoSQL #CVE202611933 #InfoSec https://securityonline.info/mongodb-server-vulnerability https://t.co/7bVHxepTnE
Post summary
The tweet announces a use‑after‑free vulnerability (CVE‑2026‑11933) in MongoDB that can crash servers or leak memory and urges users to apply the patch immediately.
05073515
12.8K followersView on X
CERT-PY@CERTpy123d
General
⚠️ Vulnerabilidad en productos MongoDB ❗ CVE-2026-11933 ➡️ Más info: https://www.cert.gov.py/vulnerabilidad-en-productos-mongodb-4/ https://t.co/cJgm5aqbU0
Post summary
The post announces the existence of CVE-2026-11933 affecting MongoDB products but provides no technical, exploit, or patch information.
00001259
6.7K followersView on X
CERT-PY@CERTpy124d
General
⚠️ Vulnerabilidad en productos MongoDB ❗ CVE-2026-11933 ➡️ Más info: https://www.cert.gov.py/vulnerabilidad-en-productos-mongodb-4/ https://t.co/NdNNiVfjSv
Post summary
The tweet links to an advisory about CVE‑2026‑11933 affecting MongoDB products, but offers no additional details on proof of concept, exploitation, fixes, or technical specifics.
00010194
6.7K followersView on X
The NoSQL Nerd@NoSQLNerd118d
Patch
MongoDB Server just patched CVE-2026-11933, an 8.7 CVSS use-after-free in the JS engine. Authenticated users can crash mongod or leak memory via $where. Also CVE-2026-9740, an unauth BSON recursion DoS. https://securityonline.info/mongodb-server-vulnerability
Post summary
MongoDB Server patched CVE-2026-11933 (8.7 CVSS use‑after‑free) and CVE-2026-9740 (unauthored BSON recursion DoS), with technical details provided and no active exploitation reported.
0000044
16 followersView on X
The NoSQL Nerd@NoSQLNerd123d
Patch
Warning, MongoDB Server 8.3.3 and earlier: CVE-2026-11933 hits 8.8 CVSS. Memory-after-free in the BSON-to-JS engine lets an authenticated user read process memory or crash mongod. Patch to 8.3.4 now. https://www.cert.gov.py/vulnerabilidad-en-productos-mongodb-4/
Post summary
The post warns of CVE-2026-11933, a memory-after-free bug with CVSS 8.8 affecting MongoDB Server 8.3.3 and earlier, and announces that patch 8.3.4 is available.
0000030
16 followersView on X
The NoSQL Nerd@NoSQLNerd131d
Patch
MongoDB Server CVE-2026-11933: a use-after-free in the vulnerability chain lets attackers crash nodes or leak memory. If you run MongoDB in prod, check your version and patch this week. https://securityonline.info/mongodb-server-vulnerability
Post summary
CVE-2026-11933 is a use‑after‑free bug in MongoDB that can crash nodes or leak memory; users are urged to verify their MongoDB version and apply the vendor patch this week.
0000041
14 followersView on X
Upwind Security MDR@UpwindMDR136d
Disclosure
🚨 High - Use-After-Free Vulnerability in MongoDB Server (CVE-2026-11933) A memory corruption flaw has been identified in MongoDB's server-side JavaScript engine during BSON to JavaScript array conversions. An authenticated user with read privileges who can execute server-side JavaScript (e.g., via $where or $function) can trigger the issue. 👉 Impact | Exploitation can lead to a server crash (Denial of Service) or potential information disclosure from the mongod process memory. Review access permissions and restrict server-side JS execution out of caution.
Post summary
The post discloses a use‑after‑free flaw in MongoDB’s JavaScript engine that can lead to denial‑of‑service or potential information disclosure, and recommends limiting server‑side JS execution as a mitigation.
0000061
216 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	mongodb	mongodb	-	-	-

Explore more

Back to dashboard mongodb CVEs mongodb vulnerabilities

What researchers are saying

CVE-2026-11933

The NoSQL Nerd[verified]@NoSQLNerdPatch

MongoDB Server patched CVE-2026-11933 (8.7 CVSS use‑after‑free) and CVE-2026-9740 (unauthored BSON recursion DoS), with technical details provided and no active exploitation reported.

The NoSQL Nerd[verified]@NoSQLNerdPatch

The post warns of CVE-2026-11933, a memory-after-free bug with CVSS 8.8 affecting MongoDB Server 8.3.3 and earlier, and announces that patch 8.3.4 is available.

The NoSQL Nerd[verified]@NoSQLNerdPatch

CVE-2026-11933 is a use‑after‑free bug in MongoDB that can crash nodes or leak memory; users are urged to verify their MongoDB version and apply the vendor patch this week.

Upwind Security MDR[verified]@UpwindMDRDisclosure

The post discloses a use‑after‑free flaw in MongoDB’s JavaScript engine that can lead to denial‑of‑service or potential information disclosure, and recommends limiting server‑side JS execution as a mitigation.

Daily CyberSecurity@the_yellow_fallPatch

The tweet announces a use‑after‑free vulnerability (CVE‑2026‑11933) in MongoDB that can crash servers or leak memory and urges users to apply the patch immediately.

CERT-PY@CERTpyGeneral

The post announces the existence of CVE-2026-11933 affecting MongoDB products but provides no technical, exploit, or patch information.

CERT-PY@CERTpyGeneral

The tweet links to an advisory about CVE‑2026‑11933 affecting MongoDB products, but offers no additional details on proof of concept, exploitation, fixes, or technical specifics.