MongoDB
Databases · products/mongodb.yaml · RSS
Latest 9.0.4 Oct 14, 2026
Lifecycle
| Branch | Latest | Released | End of life |
|---|---|---|---|
| 9.0 | 9.0.4 | Sep 30, 2026 | Oct 31, 2031 · maintained |
| 8.3 | 8.3.13 | May 31, 2026 | Oct 31, 2029 · maintained |
| 8.2 | 8.2.12 | Sep 30, 2025 | Jul 31, 2026 · ended |
| 8.1 | 8.1.3 | Jun 30, 2025 | Sep 30, 2025 · ended |
| 8.0 | 8.0.34 | Oct 31, 2024 | Oct 31, 2029 · maintained |
| 7.3 | 7.3.4 | Mar 31, 2024 | Oct 2, 2024 · ended |
| 7.2 | 7.2.2 | Jan 31, 2024 | Mar 27, 2024 · ended |
| 7.1 | 7.1.1 | Oct 31, 2023 | Jan 23, 2024 · ended |
| 7.0 | 7.0.45 | Aug 31, 2023 | Aug 31, 2027 · maintained |
| 6.3 | 6.3.2 | Apr 30, 2023 | Aug 31, 2023 · ended |
| 6.2 | 6.2.1 | Feb 28, 2023 | Apr 24, 2023 · ended |
| 6.1 | 6.1.1 | Oct 31, 2022 | Feb 9, 2023 · ended |
| 6.0 | 6.0.29 | Jul 31, 2022 | Jul 31, 2025 · ended |
| 5.3 | 5.3.2 | Mar 31, 2022 | Jul 19, 2022 · ended |
| 5.2 | 5.2.1 | Jan 31, 2022 | Mar 23, 2022 · ended |
| 5.1 | 5.1.1 | Nov 30, 2021 | Jan 19, 2022 · ended |
| 5.0 | 5.0.34 | Jul 31, 2021 | Oct 31, 2024 · ended |
| 4.4 | 4.4.31 | Jul 31, 2020 | Feb 29, 2024 · ended |
| 4.2 | 4.2.25 | Aug 31, 2019 | Apr 30, 2023 · ended |
| 4.0 | 4.0.28 | Jun 30, 2018 | Apr 30, 2022 · ended |
| 3.6 | 3.6.23 | Nov 30, 2017 | Apr 30, 2021 · ended |
| 3.4 | 3.4.24 | Nov 30, 2016 | Jan 31, 2020 · ended |
| 3.2 | 3.2.22 | Dec 31, 2015 | Sep 30, 2018 · ended |
| 3.0 | 3.0.15 | Mar 31, 2015 | Feb 28, 2018 · ended |
| 2.6 | 2.6.12 | Apr 7, 2014 | Oct 31, 2016 · ended |
| 2.4 | 2.4.14 | Mar 18, 2013 | Mar 31, 2013 · ended |
| 2.2 | 2.2.7 | Aug 28, 2012 | Feb 28, 2014 · ended |
| 2.0 | 2.0.9 | Sep 11, 2011 | Mar 31, 2013 · ended |
| 1.8 | 1.8.5 | Mar 16, 2011 | Sep 30, 2012 · ended |
| 1.6 | 1.6.5 | Aug 5, 2010 | Feb 28, 2012 · ended |
| 1.4 | 1.4.5 | Mar 25, 2010 | Sep 30, 2012 · ended |
| 1.2 | 1.2.5 | Dec 10, 2009 | Jun 30, 2011 · ended |
| 1.0 | 1.0.1 | Aug 27, 2009 | Aug 31, 2010 · ended |
Recent releases
securityCVE-2026-96297
securityCVE-2026-96299
securityCVE-2026-103965
securityCVE-2026-89099
securityCVE-2026-82059
securityCVE-2026-82058
securityCVE-2026-82057
securityFixes CVE-2026-82070: A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected credentials from concurrent administra…
securityCVE-2026-18687
securityCVE-2026-18688
securityCVE-2026-9737
securityCVE-2026-13055
securityCVE-2026-13056
securityMongoDB 8.3.4 contains a fix for CVE-2026-11933
securityFixes CVE-2026-9754: An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command
securityCVE-2026-9735
securityCVE-2026-9740
securityFixes CVE-2026-8336: After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subsequently crash mongod when the…
securityFixes CVE-2026-8199: An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear. This contributes to memory pressure an…
securityFixes CVE-2026-8201: A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared. Triggering this vulnerability r…
securityCVE-2026-8199
securityCVE-2026-8200
securityCVE-2026-8201
securityMongoDB 8.3 includes fixes for CVE-2025-12893, CVE-2025-13507, CVE-2025-14345, and CVE-2026-8336, CVE-2026-9754.
securityFor the latest information about MongoDB security updates, see MongoDB Security Bulletins.
securityFixes CVE-2026-13072: When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potenti…
securityFixes CVE-2026-13059: An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain…
securityFixes CVE-2026-13078: A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files…
securityFixes CVE-2026-11933: A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated user with read privileges who is able t…
securityFixes CVE-2026-9753: The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bounds or crash the server. $_internalApp…
securityFixes CVE-2026-9740: A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod process by sending a specially crafted message. The BSON validator's handling of certain…
securityFixes CVE-2026-9742: When OIDC authentication is enabled in configuration, clients may set specific values in the "mechanism" parameter of the "authenticate" command that lead to server crash. The authenticate command…
Security advisories
7.5 CVE-2026-89099 A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory without synchronization, leading to memory corruption. An a…
6.5 CVE-2026-82070 A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected credentials from concurrent administra…
8.1 CVE-2026-82071 Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted parameters during collection creation that ove…
6.5 CVE-2026-82073 A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization checks and access data from unauthorized co…
6.5 CVE-2026-82074 MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggregation request that…
7.5 CVE-2026-82075 An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process. A client that has network access to a router port and has not authen…
6.5 CVE-2026-82076 An integer overflow in the query planning component of MongoDB Server can allow an authenticated user with ordinary database-level read/write privileges to bypass an internal resource limit. Submit…
5.3 CVE-2026-82063 A use-after-free security issue in the cursor management component of MongoDB Server allows an authenticated user to cause a denial of service. Under specific timing conditions during cursor operat…
7.5 CVE-2026-82064 A security issue in MongoDB Server allows an unauthenticated network user to cause a denial of service on a specific type of replica set member. The server contains an assertion in its read concern…
6.5 CVE-2026-82065 A security issue in the MongoDB Server's storage engine integration layer allows an authenticated user with collection creation privileges to cause a persistent denial of service. Insufficient vali…
4.3 CVE-2026-82066 A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user with database read and write privileges can trigger the security issue throu…
8.1 CVE-2026-82067 Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup.…
6.5 CVE-2026-82068 A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal assertion crash by sending specially crafted retryable write commands. The crash…
2.7 CVE-2026-82069 A security issue in MongoDB Server's query statistics serialization on the router allows users with monitoring privileges to access unredacted search query text from other users' operations. An imp…
6.5 CVE-2026-82057 A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By specifying a custom WiredTiger storage configuration optio…
6.5 CVE-2026-82058 A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges to crash the mongod server. When a BSON document containing an array with a m…
5.3 CVE-2026-82059 An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to internal cluster operations. By crafting a ma…
5.4 CVE-2026-82060 In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operator-shaped objects as shard key values…
8.1 CVE-2026-82061 A use-after-free security issue exists in the server's query execution memory tracking subsystem. An authenticated user with read privileges can trigger a write to freed heap memory through a seque…
5.5 CVE-2026-82062 A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the applyOps command by specifying an internal replication mod…
Sources
- github https://github.com/mongodb/mongo/tags
- html https://www.mongodb.com/docs/manual/release-notes/8.3/
- html https://www.mongodb.com/docs/manual/release-notes/8.0/
- html https://www.mongodb.com/docs/manual/release-notes/7.0/
- nvd https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Amongodb%3Amongodb
- endoflife https://endoflife.date/mongodb