CVE-2026-120819
Use-after-free in Wasm JS-BSON bridge lets read-only users read 24 KiB via $accumulator
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
A memory-management flaw in the server-side JavaScript execution component of MongoDB Server can allow an authenticated user holding only read privileges to cause the server to access memory that has already been released. By submitting a specially crafted database command that runs user-supplied JavaScript, the user can cause a bounded amount of adjacent process memory to be returned in the command's result. This results in the user obtaining information they are not authorized to access. Integrity and availability are not affected.
| CWE | CWE-416 |
| Vendor | mongodb |
| Product | mongodb server |
| Ecosystems | |
| Industries | Technology |
| Published | Nov 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for mongodb mongodb server
Be the first to know when new medium vulnerabilities affecting mongodb mongodb server are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
MongoDB / MongoDB Server
9.0.0 < 9.0.7