CVE-2026-120818
Use-After-Free in MongoDB Server JavaScript Support for Aggregation Leads to Information Disclosure
A use-after-free weakness in MongoDB Server's server-side JavaScript support for aggregation may allow a stale reference to previously freed process memory to be read and returned. An authenticated user with minimal or no assigned roles can trigger this condition over the normal network protocol by submitting a single crafted aggregation request, with no additional privileges or non-default configuration. Successful triggering this issue may result in adjacent process memory contents being returned, including data that undermines memory-layout randomization, and may in some cases affect server availability.
| CWE | CWE-416 |
| Vendor | mongodb |
| Product | mongodb server |
| Ecosystems | |
| Industries | Technology |
| Published | Nov 10, 2026 |
Get instant alerts for mongodb mongodb server
Be the first to know when new high vulnerabilities affecting mongodb mongodb server are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L