MongoDB 6.3.2 → 8.3.4

104 releases · 0 breaking changes · 325 security fixes · 3 advisories fixed

325security0breaking2deprecated25feature43fix

Is 6.3.2 affected? · What changed up to 9.0.4

Vulnerabilities fixed by this upgrade

8.1 CVE-2026-9753 The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bounds or crash the server. $_internalApp…
5.0 CVE-2025-12657 The KMIP response parser built into mongo binaries is overly tolerant of certain malformed packets, and may parse them into invalid objects. Later reads of this object can result in read access vio…
5.3 CVE-2023-1409 If the MongoDB Server running on Windows or macOS is configured to use TLS with a specific set of configuration options that are already known to work securely in other platforms (e.g. Linux), it i…

Breaking changes

None in the release notes.

Security changes

security MongoDB 8.3.4 contains a fix for CVE-2026-11933 in 8.3.4
security Fixes CVE-2026-9754: An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command in 8.3.3
security CVE-2026-9735 in 8.3.3
security CVE-2026-9740 in 8.3.3
security CVE-2026-9741 in 8.3.3
security CVE-2026-9742 in 8.3.3
security CVE-2026-9746 in 8.3.3
security CVE-2026-9747 in 8.3.3
security CVE-2026-9748 in 8.3.3
security CVE-2026-9749 in 8.3.3
security CVE-2026-9750 in 8.3.3
security CVE-2026-9751 in 8.3.3
security CVE-2026-9752 in 8.3.3
security CVE-2026-9753 in 8.3.3
security Fixes CVE-2026-8336: After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subsequently crash mongod when the… in 8.3.2
security Fixes CVE-2026-8199: An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear. This contributes to memory pressure an… in 8.3.2
security Fixes CVE-2026-8201: A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared. Triggering this vulnerability r… in 8.3.2
security Fixes CVE-2026-8202: Using a densely populated chars mask and a large input string in the MongoDB aggregation operators $trim, $ltrim, and $rtrim, an authenticated user with aggregation permissions can pin CPU utilizat… in 8.3.2
security Fixes CVE-2026-8200: When schema validation is enabled on a collection and an update or insert would violate the collection's schema, the local server log message generated may not have all user data redacted. This… in 8.3.2
security MongoDB 8.3.2 contains a fix for CVE-2026-8053 in 8.3.2
security CVE-2026-8199 in 8.3.1
security CVE-2026-8200 in 8.3.1
security CVE-2026-8201 in 8.3.1
security CVE-2026-8202 in 8.3.1
security CVE-2026-8336 in 8.3.1
security MongoDB 8.3 includes fixes for CVE-2025-12893, CVE-2025-13507, CVE-2025-14345, and CVE-2026-8336, CVE-2026-9754. in 8.3.0
security For the latest information about MongoDB security updates, see MongoDB Security Bulletins. in 8.3.0
security Fixes CVE-2026-13072: When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potenti… in 8.2.12
security Fixes CVE-2026-13059: An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain… in 8.2.12
security Fixes CVE-2026-13078: A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files… in 8.2.12
security Fixes CVE-2026-13077: A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an… in 8.2.12
security Fixes CVE-2026-13075: An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The issue originates in th… in 8.2.12
security Fixes CVE-2026-13069: An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used… in 8.2.12
security Fixes CVE-2026-13071: An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory… in 8.2.12
security Fixes CVE-2026-13062: An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by send… in 8.2.12
security Fixes CVE-2026-13064: Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading to resource exhaustion. The… in 8.2.12
security Fixes CVE-2026-13065: A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to termin… in 8.2.12
security Fixes CVE-2026-13066: Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the cli… in 8.2.12
security Fixes CVE-2026-13055: The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle compound wildcard index specifications, trig… in 8.2.12
security Fixes CVE-2026-13058: An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomplete set of required fields. The issue… in 8.2.12
security Fixes CVE-2026-13060: An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stag… in 8.2.12
security Fixes CVE-2026-13074: An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's… in 8.2.12
security Fixes CVE-2026-13070: A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCSP stapling validation is en… in 8.2.12
security Fixes CVE-2026-13057: An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user access controls. In sharded topologies, the $search and $searchMeta aggregation stages use inter… in 8.2.12
security Fixes CVE-2026-13063: An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted aggregation command. MongoDB's libmongocry… in 8.2.12
security Fixes CVE-2026-13068: An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for… in 8.2.12
security Fixes CVE-2026-11933: A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated user with read privileges who is able t… in 8.2.11
security Fixes CVE-2026-9753: The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bounds or crash the server. $_internalApp… in 8.2.10
security Fixes CVE-2026-9740: A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod process by sending a specially crafted message. The BSON validator's handling of certain… in 8.2.10
security Fixes CVE-2026-9742: When OIDC authentication is enabled in configuration, clients may set specific values in the "mechanism" parameter of the "authenticate" command that lead to server crash. The authenticate command… in 8.2.10
security Fixes CVE-2026-9754: An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command in 8.2.10
security Fixes CVE-2026-9747: Adding fromRouter:true and runtimeConstants.userRoles could cause aggregations to crash mongodb server. in 8.2.10
security Fixes CVE-2026-9748: The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index stats conversion failed. But PauseExecution is not a general purpose skip mecha… in 8.2.10
security Fixes CVE-2026-9749: This issue can occur when running an aggregation pipeline that uses the internal $exchange stage configured with key-range partitioning and order-preserving delivery. If a single key range produces… in 8.2.10
security Fixes CVE-2026-9750: An authenticated user can cause a MongoDB server to crash or return incorrect results by creating documents that interfere with internal metadata processing during query execution. This stems from… in 8.2.10
security Fixes CVE-2026-9752: An authorized user could trigger a server crash by running a query with a 2dsphere index on a field that stores a GeoJSON GeometryCollection containing a Polygon with a strict-winding CRS. Strict-… in 8.2.10
security Fixes CVE-2026-9741: A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE) results in literal values for encrypted fields… in 8.2.10
security Fixes CVE-2026-9746: When using $changestreams and $_requestReshardingResumeToken with the exchange option the server hits an invariant which causes the server to crash. There are no special privileges needed. The user… in 8.2.10
security Fixes CVE-2026-9751: The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mongod.log file in plain text. in 8.2.10
security Fixes CVE-2026-8053: An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds memory write in the mongod process. The is… in 8.2.9
security Fixes CVE-2026-8336: After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subsequently crash mongod when the… in 8.2.9
security Fixes CVE-2026-8199: An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear. This contributes to memory pressure an… in 8.2.9
security Fixes CVE-2026-8201: A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared. Triggering this vulnerability r… in 8.2.9
security Fixes CVE-2026-8202: Using a densely populated chars mask and a large input string in the MongoDB aggregation operators $trim, $ltrim, and $rtrim, an authenticated user with aggregation permissions can pin CPU utilizat… in 8.2.9
security Fixes CVE-2026-8200: When schema validation is enabled on a collection and an update or insert would violate the collection's schema, the local server log message generated may not have all user data redacted. This… in 8.2.9
security Fixes CVE-2026-8063: An authenticated user can crash mongod when running $rankFusion or $scoreFusion with an empty pipeline on a view. When resolving a view, the server inspects the aggregation pipeline to determine w… in 8.2.7
security Fixes CVE-2026-6914: Computing the MD5 checksum of a malformed BSON object under specific conditions may cause loss of availability in MongoDB server. This issue affects all MongoDB Server v8.2 versions, all MongoDB Se… in 8.2.7
security Fixes CVE-2026-6915: An authorization flaw in the user management command could allow an authenticated user to make limited changes to authentication-related data associated with another user account. This could affect… in 8.2.7
security Fixes CVE-2026-4148: A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who issues a specially crafted $lookup or $graphLookup aggregation pipeline. in 8.2.6
security Fixes CVE-2026-8843: Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server. A si… in 8.2.6
security Fixes CVE-2026-4147: An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command. in 8.2.6
security Fixes CVE-2026-4358: A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-free or use-after-free memory issue in the slot-based execution (SBE) engine whe… in 8.2.6
security Fixes CVE-2026-1848: Connections received from the proxy port may not count towards total accepted connections, resulting in server crashes if the total number of connections exceeds available resources. This only appl… in 8.2.4
security Fixes CVE-2026-25613: An authorized user may disable the MongoDB server by issuing a query against a collection that contains an invalid compound wildcard index. in 8.2.4
security Fixes CVE-2026-1847: Inserting certain large documents into a replica set could lead to replica set secondaries not being able to fetch the oplog from the primary. This could stall replication inside the replica set le… in 8.2.4
security Fixes CVE-2026-1850: Complex queries can cause excessive memory usage in MongoDB Query Planner resulting in an Out-Of-Memory Crash. in 8.2.4
security Fixes CVE-2026-25609: Incorrect validation of the profile command may result in the determination that a request altering the 'filter' is read-only. in 8.2.4
security Fixes CVE-2025-14847: Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 v… in 8.2.3
security Fixes CVE-2026-1849: MongoDB Server may experience an out-of-memory failure while evaluating expressions that produce deeply nested documents. The issue arises in recursive functions because the server does not periodi… in 8.2.2
security Fixes CVE-2026-5170: A user with access to the cluster with a limited set of privilege actions can trigger a crash of a mongod process during the limited and unpredictable window when the cluster is being promoted from… in 8.2.2
security Fixes CVE-2025-14345: A post-authentication flaw in the network two-phase commit protocol used for cross-shard transactions in MongoDB Server may lead to logical data inconsistencies under specific conditions which are… in 8.2.2
security Fixes CVE-2025-12893: Clients may successfully perform a TLS handshake with a MongoDB server despite presenting a client certificate not aligning with the documented Extended Key Usage (EKU) requirements. A certificate… in 8.2.2
security Fixes CVE-2025-13507: Inconsistent object size validation in time series processing logic may result in later processing of oversized BSON documents leading to an assert failing and process termination. This issue impa… in 8.2.1
security Fixes CVE-2025-13644: MongoDB Server may experience an invariant failure during batched delete operations when handling documents. The issue arises when the server mistakenly assumes the presence of multiple documents i… in 8.1.2
security Fixes CVE-2025-10061: An authorized user can cause a crash in the MongoDB Server through a specially crafted $group query. This vulnerability is related to the incorrect handling of certain accumulator functions when ad… in 8.1.2
security CVE-2026-96297 in 8.0.34
security CVE-2026-103965 in 8.0.34
security CVE-2026-104004 in 8.0.34
security CVE-2026-89099 in 8.0.32
security CVE-2026-82056 in 8.0.30
security CVE-2026-82054 in 8.0.30
security CVE-2026-82053 in 8.0.30
security CVE-2026-82076 in 8.0.30
security CVE-2026-82075 in 8.0.30
security CVE-2026-82074 in 8.0.30
security CVE-2026-82071 in 8.0.30
security CVE-2026-82070 in 8.0.30
security CVE-2026-82068 in 8.0.30
security CVE-2026-82067 in 8.0.30
security CVE-2026-82066 in 8.0.30
security CVE-2026-82065 in 8.0.30
security CVE-2026-82064 in 8.0.30
security CVE-2026-82063 in 8.0.30
security CVE-2026-82060 in 8.0.30
security CVE-2026-82052 in 8.0.30
security CVE-2026-82059 in 8.0.30
security CVE-2026-82058 in 8.0.30
security SERVER-128253 Integer overflow in query planner explodeForSort() can trigger mongod denial of service in 8.0.30
security Fixes CVE-2026-18692: An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory ha… in 8.0.29
security Fixes CVE-2026-82070: A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected credentials from concurrent administra… in 8.0.29
security Fixes CVE-2026-18707: An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to terminate unexpectedly by submitting a specially formed aggre… in 8.0.29
security CVE-2026-18687 in 8.0.29
security CVE-2026-18688 in 8.0.29
security CVE-2026-18690 in 8.0.29
security CVE-2026-18691 in 8.0.29
security CVE-2026-18693 in 8.0.29
security CVE-2026-18694 in 8.0.29
security CVE-2026-18695 in 8.0.29
security CVE-2026-18696 in 8.0.29
security CVE-2026-18697 in 8.0.29
security CVE-2026-18698 in 8.0.29
security CVE-2026-18699 in 8.0.29
security CVE-2026-18700 in 8.0.29
security CVE-2026-18701 in 8.0.29
security CVE-2026-18702 in 8.0.29
security CVE-2026-18705 in 8.0.29
security CVE-2026-18708 in 8.0.29
security CVE-2026-18709 in 8.0.29
security CVE-2026-18711 in 8.0.29
security CVE-2026-18712 in 8.0.29
security CVE-2026-9737 in 8.0.28
security CVE-2026-13055 in 8.0.28
security CVE-2026-13056 in 8.0.28
security CVE-2026-13057 in 8.0.28
security CVE-2026-13058 in 8.0.28
security CVE-2026-13059 in 8.0.28
security CVE-2026-13060 in 8.0.28
security CVE-2026-13061 in 8.0.28
security CVE-2026-13062 in 8.0.28
security CVE-2026-13064 in 8.0.28
security CVE-2026-13065 in 8.0.28
security CVE-2026-13066 in 8.0.28
security CVE-2026-13067 in 8.0.28
security CVE-2026-13068 in 8.0.28
security CVE-2026-13069 in 8.0.28
security CVE-2026-13070 in 8.0.28
security CVE-2026-13071 in 8.0.28
security CVE-2026-13072 in 8.0.28
security CVE-2026-13073 in 8.0.28
security CVE-2026-13074 in 8.0.28
security CVE-2026-13077 in 8.0.28
security CVE-2026-13078 in 8.0.28
security MongoDB 8.0.26 contains a fix for CVE-2026-11933 in 8.0.26
security CVE-2026-9740 in 8.0.24
security CVE-2026-9741 in 8.0.24
security CVE-2026-9743 in 8.0.24
security CVE-2026-9746 in 8.0.24
security CVE-2026-9747 in 8.0.24
security CVE-2026-9748 in 8.0.24
security CVE-2026-9749 in 8.0.24
security CVE-2026-9750 in 8.0.24
security CVE-2026-9751 in 8.0.24
security CVE-2026-9752 in 8.0.24
security CVE-2026-9753 in 8.0.24
security CVE-2026-8053 in 8.0.23
security CVE-2026-8199 in 8.0.23
security CVE-2026-8200 in 8.0.23
security CVE-2026-8201 in 8.0.23
security CVE-2026-8202 in 8.0.23
security Fixes CVE-2026-8843: Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server. A si… in 8.0.21
security CVE-2026-6914 in 8.0.21
security CVE-2026-6915 in 8.0.21
security Fixes CVE-2026-4358: A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-free or use-after-free memory issue in the slot-based execution (SBE) engine whe… in 8.0.20
security CVE-2026-4147 in 8.0.20
security CVE-2026-4148 in 8.0.20
security Fixes CVE-2026-5170: A user with access to the cluster with a limited set of privilege actions can trigger a crash of a mongod process during the limited and unpredictable window when the cluster is being promoted from… in 8.0.18
security CVE-2026-1847 in 8.0.18
security CVE-2026-1848 in 8.0.18
security CVE-2026-1849 in 8.0.18
security CVE-2026-1850 in 8.0.18
security CVE-2026-25609 in 8.0.18
security CVE-2026-25611 in 8.0.18
security CVE-2026-25612 in 8.0.18
security CVE-2026-25613 in 8.0.18
security MongoDB 8.0.17 contains a fix for CVE-2025-14847. in 8.0.17
security MongoDB 8.0.16 includes fixes for CVE-2025-12893, CVE-2025-13507, and CVE-2025-14345. in 8.0.16
security Fixes CVE-2025-11979: An authorized user may crash the MongoDB server by causing buffer over-read. This can be done by issuing a DDL operation while queries are being issued, under some conditions. This issue affects Mo… in 8.0.15
security MongoDB 8.0.14 includes a fix for CVE-2025-13643. in 8.0.14
security Fixes CVE-2026-25610: An authorized user may trigger a server crash by running a $geoNear pipeline with certain invalid index hints. in 8.0.13
security MongoDB 8.0.13 includes a fix for CVE-2025-13644. in 8.0.13
security Fixes CVE-2025-10061: An authorized user can cause a crash in the MongoDB Server through a specially crafted $group query. This vulnerability is related to the incorrect handling of certain accumulator functions when ad… in 8.0.12
security Fixes CVE-2025-10060: MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure and server crash during commit. This issue may… in 8.0.12
security Fixes CVE-2026-9748: The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index stats conversion failed. But PauseExecution is not a general purpose skip mecha… in 8.0.10
security Fixes CVE-2025-6712: MongoDB Server may be susceptible to disruption caused by high memory usage, potentially leading to server crash. This condition is linked to inefficiencies in memory management related to internal… in 8.0.10
security Fixes CVE-2025-12657: The KMIP response parser built into mongo binaries is overly tolerant of certain malformed packets, and may parse them into invalid objects. Later reads of this object can result in read access vio… in 8.0.10
security Fixes CVE-2025-6714: MongoDB Server's mongos component can become unresponsive to new connections due to incorrect handling of incomplete data. This affects MongoDB when configured with load balancer support. This issu… in 8.0.9
security Fixes CVE-2025-6713: An unauthorized user may leverage a specially crafted aggregation pipeline to access data without proper authorization due to improper handling of the $mergeCursors stage in MongoDB Server. This ma… in 8.0.7
security Fixes CVE-2025-10059: An improper setting of the lsid field on any sharded query can cause a crash in MongoDB routers. This issue occurs when a generic argument (lsid) is provided in a case when it is not applicable. Th… in 8.0.6
security Fixes CVE-2025-6709: The MongoDB Server is susceptible to a denial of service vulnerability due to improper handling of specific date values in JSON input when using OIDC authentication. This can be reproduced using th… in 8.0.5
security Fixes CVE-2025-6710: MongoDB Server may be susceptible to stack overflow due to JSON parsing mechanism, where specifically crafted JSON inputs may induce unwarranted levels of recursion, resulting in excessive stack sp… in 8.0.5
security Fixes CVE-2025-6711: An issue has been identified in MongoDB Server where unredacted queries may inadvertently appear in server logs when certain error conditions are encountered. This issue affects MongoDB Server v8.0… in 8.0.5
security Fixes CVE-2025-6707: Under certain conditions, an authenticated user request may execute with stale privileges following an intentional change by an authorized administrator. This issue affects MongoDB Server v5.0 vers… in 8.0.5
security Fixes CVE-2025-3085: A MongoDB server under specific conditions running on Linux with TLS and CRL revocation status checking enabled, fails to check the revocation status of the intermediate certificates in the peer's… in 8.0.4
security Fixes CVE-2025-3084: When run on commands with certain arguments set, explain may fail to validate these arguments before using them. This can lead to crashes in router servers. This affects MongoDB Server v5.0 prior t… in 8.0.4
security Fixes CVE-2025-6706: An authenticated user may trigger a use after free that may result in MongoDB Server crash and other unexpected behavior, even if the user does not have authorization to shut down a server. The cra… in 8.0.4
security Fixes CVE-2024-10921: An authorized user may trigger crashes or receive the contents of buffer over-reads of Server memory by issuing specially crafted requests that construct malformed BSON in the MongoDB Server. This… in 8.0.3
security Fixes CVE-2024-8305: prepareUnique index may cause secondaries to crash due to incorrect enforcement of index constraints on secondaries, where in extreme cases may cause multiple secondaries crashing leading to no pri… in 7.3.4
security Fixes CVE-2025-3082: A user authorized to access a view may be able to alter the intended collation, allowing them to access to a different or unintended view of underlying data. This issue affects MongoDB Server v5.0… in 7.3.4
security Fixes CVE-2024-7553: Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executi… in 7.3.3
security Fixes CVE-2024-6384: "Hot" backup files may be downloaded by underprivileged users, if they are capable of acquiring a unique backup identifier. This issue affects MongoDB Enterprise Server v6.0 versions prior to 6.0.1… in 7.3.3
security CVE-2026-96297 in 7.0.45
security CVE-2026-103965 in 7.0.45
security CVE-2026-89099 in 7.0.43
security Fixes CVE-2026-82056: A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert retry paths. Under certain concurrent index lifecycle operations, a raw point… in 7.0.41
security CVE-2026-82054 in 7.0.41
security CVE-2026-82053 in 7.0.41
security CVE-2026-82076 in 7.0.41
security CVE-2026-82075 in 7.0.41
security CVE-2026-82074 in 7.0.41
security CVE-2026-82071 in 7.0.41
security CVE-2026-82070 in 7.0.41
security CVE-2026-82068 in 7.0.41
security CVE-2026-82067 in 7.0.41
security CVE-2026-82066 in 7.0.41
security CVE-2026-82065 in 7.0.41
security CVE-2026-82064 in 7.0.41
security CVE-2026-82063 in 7.0.41
security CVE-2026-82060 in 7.0.41
security CVE-2026-82052 in 7.0.41
security CVE-2026-82059 in 7.0.41
security CVE-2026-82058 in 7.0.41
security SERVER-128253 Integer overflow in query planner explodeForSort() can trigger mongod denial of service in 7.0.41
security Fixes CVE-2026-82070: A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected credentials from concurrent administra… in 7.0.40
security Fixes CVE-2026-18707: An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to terminate unexpectedly by submitting a specially formed aggre… in 7.0.40
security CVE-2026-18688 in 7.0.40
security CVE-2026-18690 in 7.0.40
security CVE-2026-18691 in 7.0.40
security CVE-2026-18693 in 7.0.40
security CVE-2026-18694 in 7.0.40
security CVE-2026-18695 in 7.0.40
security CVE-2026-18696 in 7.0.40
security CVE-2026-18697 in 7.0.40
security CVE-2026-18698 in 7.0.40
security CVE-2026-18699 in 7.0.40
security CVE-2026-18700 in 7.0.40
security CVE-2026-18701 in 7.0.40
security CVE-2026-18702 in 7.0.40
security CVE-2026-18705 in 7.0.40
security CVE-2026-18708 in 7.0.40
security CVE-2026-18709 in 7.0.40
security CVE-2026-18712 in 7.0.40
security CVE-2026-9737 in 7.0.39
security CVE-2026-13055 in 7.0.39
security CVE-2026-13059 in 7.0.39
security CVE-2026-13060 in 7.0.39
security CVE-2026-13061 in 7.0.39
security CVE-2026-13062 in 7.0.39
security CVE-2026-13065 in 7.0.39
security CVE-2026-13066 in 7.0.39
security CVE-2026-13068 in 7.0.39
security CVE-2026-13069 in 7.0.39
security CVE-2026-13070 in 7.0.39
security CVE-2026-13071 in 7.0.39
security CVE-2026-13072 in 7.0.39
security CVE-2026-13074 in 7.0.39
security CVE-2026-13077 in 7.0.39
security CVE-2026-13078 in 7.0.39
security MongoDB 7.0.37 contains a fix for CVE-2026-11933 in 7.0.37
security CVE-2026-9740 in 7.0.35
security CVE-2026-9741 in 7.0.35
security CVE-2026-9746 in 7.0.35
security CVE-2026-9747 in 7.0.35
security CVE-2026-9748 in 7.0.35
security CVE-2026-9749 in 7.0.35
security CVE-2026-9750 in 7.0.35
security CVE-2026-9751 in 7.0.35
security CVE-2026-9752 in 7.0.35
security CVE-2026-9753 in 7.0.35
security CVE-2026-8053 in 7.0.34
security CVE-2026-8199 in 7.0.34
security CVE-2026-8200 in 7.0.34
security CVE-2026-8201 in 7.0.34
security CVE-2026-8202 in 7.0.34
security Fixes CVE-2026-8843: Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server. A si… in 7.0.32
security CVE-2026-6914 in 7.0.32
security CVE-2026-6915 in 7.0.32
security Fixes CVE-2026-4358: A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-free or use-after-free memory issue in the slot-based execution (SBE) engine whe… in 7.0.31
security Fixes CVE-2026-5170: A user with access to the cluster with a limited set of privilege actions can trigger a crash of a mongod process during the limited and unpredictable window when the cluster is being promoted from… in 7.0.31
security CVE-2026-4147 in 7.0.31
security CVE-2026-4148 in 7.0.31
security CVE-2026-1847 in 7.0.29
security CVE-2026-1848 in 7.0.29
security CVE-2026-1849 in 7.0.29
security CVE-2026-1850 in 7.0.29
security CVE-2026-25609 in 7.0.29
security CVE-2026-25610 in 7.0.29
security CVE-2026-25611 in 7.0.29
security CVE-2026-25612 in 7.0.29
security CVE-2026-25613 in 7.0.29
security MongoDB 7.0.28 contains a fix for CVE-2025-14847. in 7.0.28
security MongoDB 7.0.26 includes fixes for CVE-2025-12893, CVE-2025-13507, CVE-2025-13643, CVE-2025-13644, and CVE-2025-14345. in 7.0.26
security Fixes CVE-2025-11979: An authorized user may crash the MongoDB server by causing buffer over-read. This can be done by issuing a DDL operation while queries are being issued, under some conditions. This issue affects Mo… in 7.0.25
security Fixes CVE-2025-10061: An authorized user can cause a crash in the MongoDB Server through a specially crafted $group query. This vulnerability is related to the incorrect handling of certain accumulator functions when ad… in 7.0.22
security Fixes CVE-2025-10060: MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure and server crash during commit. This issue may… in 7.0.22
security Fixes CVE-2025-12657: The KMIP response parser built into mongo binaries is overly tolerant of certain malformed packets, and may parse them into invalid objects. Later reads of this object can result in read access vio… in 7.0.22
security Fixes CVE-2025-6707: Under certain conditions, an authenticated user request may execute with stale privileges following an intentional change by an authorized administrator. This issue affects MongoDB Server v5.0 vers… in 7.0.21
security Fixes CVE-2025-6714: MongoDB Server's mongos component can become unresponsive to new connections due to incorrect handling of incomplete data. This affects MongoDB when configured with load balancer support. This issu… in 7.0.20
security Fixes CVE-2025-6713: An unauthorized user may leverage a specially crafted aggregation pipeline to access data without proper authorization due to improper handling of the $mergeCursors stage in MongoDB Server. This ma… in 7.0.19
security Fixes CVE-2025-10059: An improper setting of the lsid field on any sharded query can cause a crash in MongoDB routers. This issue occurs when a generic argument (lsid) is provided in a case when it is not applicable. Th… in 7.0.18
security Fixes CVE-2025-6711: An issue has been identified in MongoDB Server where unredacted queries may inadvertently appear in server logs when certain error conditions are encountered. This issue affects MongoDB Server v8.0… in 7.0.18
security Fixes CVE-2025-6709: The MongoDB Server is susceptible to a denial of service vulnerability due to improper handling of specific date values in JSON input when using OIDC authentication. This can be reproduced using th… in 7.0.17
security Fixes CVE-2025-6710: MongoDB Server may be susceptible to stack overflow due to JSON parsing mechanism, where specifically crafted JSON inputs may induce unwarranted levels of recursion, resulting in excessive stack sp… in 7.0.17
security Fixes CVE-2025-6706: An authenticated user may trigger a use after free that may result in MongoDB Server crash and other unexpected behavior, even if the user does not have authorization to shut down a server. The cra… in 7.0.17
security Fixes CVE-2025-0755: The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maxim… in 7.0.16
security Fixes CVE-2025-3085: A MongoDB server under specific conditions running on Linux with TLS and CRL revocation status checking enabled, fails to check the revocation status of the intermediate certificates in the peer's… in 7.0.16
security Fixes CVE-2025-3083: Specifically crafted MongoDB wire protocol messages can cause mongos to crash during command validation. This can occur without using an authenticated connection. This issue affects MongoDB v5.0 ve… in 7.0.16
security Fixes CVE-2025-3084: When run on commands with certain arguments set, explain may fail to validate these arguments before using them. This can lead to crashes in router servers. This affects MongoDB Server v5.0 prior t… in 7.0.16
security Fixes CVE-2024-10921: An authorized user may trigger crashes or receive the contents of buffer over-reads of Server memory by issuing specially crafted requests that construct malformed BSON in the MongoDB Server. This… in 7.0.15
security Fixes CVE-2025-3082: A user authorized to access a view may be able to alter the intended collation, allowing them to access to a different or unintended view of underlying data. This issue affects MongoDB Server v5.0… in 7.0.14
security Fixes CVE-2024-8305: prepareUnique index may cause secondaries to crash due to incorrect enforcement of index constraints on secondaries, where in extreme cases may cause multiple secondaries crashing leading to no pri… in 7.0.13
security Fixes CVE-2024-7553: Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executi… in 7.0.12
security Fixes CVE-2024-6384: "Hot" backup files may be downloaded by underprivileged users, if they are capable of acquiring a unique backup identifier. This issue affects MongoDB Enterprise Server v6.0 versions prior to 6.0.1… in 7.0.11
security Fixes CVE-2024-1351: Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which may result in untrusted connections to succeed. This may effectively reduce the… in 7.0.6
security Fixes CVE-2024-3372: Improper validation of certain metadata input may result in the server not correctly serialising BSON. This can be performed pre-authentication and may cause unexpected application behavior includi… in 7.0.6
security Fixes CVE-2024-6375: A command for refining a collection shard key is missing an authorization check. This may cause the command to run directly on a shard, leading to either degradation of query performance, or to rev… in 7.0.3

Deprecations

deprecated SERVER-119981 Fix binDataClean() for deprecated type in 8.0.21
deprecated SERVER-119981: Fix binDataClean() for deprecated type in 7.0.32

Every release in between

8.3.4 Jun 15, 2026 Release notes ↗

securityMongoDB 8.3.4 contains a fix for CVE-2026-11933

otherSERVER-128125 Align bsonObjToArray ownership semantics with bsonGetImmutable

otherAll JIRA issues closed in 8.3.4

other8.3.4 Changelog

8.3.3 Jun 15, 2026 Release notes ↗

securityFixes CVE-2026-9754: An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command

securityCVE-2026-9735

securityCVE-2026-9740

securityCVE-2026-9741

securityCVE-2026-9742

securityCVE-2026-9746

securityCVE-2026-9747

securityCVE-2026-9748

securityCVE-2026-9749

securityCVE-2026-9750

securityCVE-2026-9751

securityCVE-2026-9752

securityCVE-2026-9753

otherSERVER-118434 Makes the CBR eligible for use during query planning

featureSERVER-115402 Adds explain output to the CBR

featureSERVER-120369 Adds serverStatus metrics for the CBR

featureSERVER-117199 Adds $queryStats metrics for the CBR

fixSERVER-115250 Pause JWKSetRefreshJob during quiesce time

fixSERVER-121822 Clustered collections do not correctly filter out results with $lt on _id

fixSERVER-125887 Add support for encrypted PEM fules for gRPC egress

fixSERVER-126049 MozJS per-scope heap limit check uses process-global GC counter

fixWT-16780 Insufficient error context in WT_PANIC checkpoint failures in __wt_block_checkpoint_resolve

fixSERVER-126506 Remove SASL params from egress logging

fixSERVER-125063 Prohibit nesting of BSONColumn inside BSONColumn

fixSERVER-123507 Encrypted predicates inside a $vectorSearch prefilter should get replaced with encryption placeholders

fixSERVER-124183 Limit scope of authenticate

fixSERVER-124190 Forbid aggregate exchange field from non-internal clients

fixSERVER-123918 Validate runtimeConstants.userRoles in IDL

fixSERVER-123951 $_internalConvertBucketIndexStats should not return PauseExecution on failed index conversion

fixSERVER-124031 Ensure Exchange::getTargetConsumer correctly handles MaxKey

fixSERVER-123633 Fix handling of user $-prefixed fields colliding with internal metadata

fixSERVER-123370 LDAP query password is logged when set through setParameter

fixSERVER-123440 GeometryCollection with strict-winding polygon causes 2dsphere index key generation crash

fixSERVER-124959 Validate doc diff array bounds and $_internalApplyOplogUpdate BSON

fixAll JIRA issues closed in 8.3.3

fix8.3.3 Changelog

8.3.2 May 14, 2026 Release notes ↗

securityFixes CVE-2026-8336: After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subsequently crash mongod when the…

securityFixes CVE-2026-8199: An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear. This contributes to memory pressure an…

securityFixes CVE-2026-8201: A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared. Triggering this vulnerability r…

securityFixes CVE-2026-8202: Using a densely populated chars mask and a large input string in the MongoDB aggregation operators $trim, $ltrim, and $rtrim, an authenticated user with aggregation permissions can pin CPU utilizat…

securityFixes CVE-2026-8200: When schema validation is enabled on a collection and an update or insert would violate the collection's schema, the local server log message generated may not have all user data redacted. This…

securityMongoDB 8.3.2 contains a fix for CVE-2026-8053

otherSERVER-126021 Undefined behavior when inserting data with duplicate field names into timeseries collections

otherAll JIRA issues closed in 8.3.2

other8.3.2 Changelog

8.3.1 Jun 3, 2026 Release notes ↗

securityCVE-2026-8199

securityCVE-2026-8200

securityCVE-2026-8201

securityCVE-2026-8202

securityCVE-2026-8336

otherSERVER-121610 Ensure cached emit() calls are no-op

otherSERVER-121895 Improve redaction of validation errors

otherSERVER-124974 Ensure memory lifetime during $match pushdown analysis

otherAll JIRA issues closed in 8.3.1

other8.3.1 Changelog

8.3.0 Jun 3, 2026 Release notes ↗

otherImportant

securityMongoDB 8.3 includes fixes for CVE-2025-12893, CVE-2025-13507, CVE-2025-14345, and CVE-2026-8336, CVE-2026-9754.

securityFor the latest information about MongoDB security updates, see MongoDB Security Bulletins.

8.2.12 Jul 28, 2026 Release notes ↗

securityFixes CVE-2026-13072: When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potenti…

securityFixes CVE-2026-13059: An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain…

securityFixes CVE-2026-13078: A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files…

securityFixes CVE-2026-13077: A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an…

securityFixes CVE-2026-13075: An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The issue originates in th…

securityFixes CVE-2026-13069: An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used…

securityFixes CVE-2026-13071: An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory…

securityFixes CVE-2026-13062: An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by send…

securityFixes CVE-2026-13064: Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading to resource exhaustion. The…

securityFixes CVE-2026-13065: A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to termin…

securityFixes CVE-2026-13066: Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the cli…

securityFixes CVE-2026-13055: The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle compound wildcard index specifications, trig…

securityFixes CVE-2026-13058: An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomplete set of required fields. The issue…

securityFixes CVE-2026-13060: An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stag…

securityFixes CVE-2026-13074: An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's…

securityFixes CVE-2026-13070: A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCSP stapling validation is en…

securityFixes CVE-2026-13057: An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user access controls. In sharded topologies, the $search and $searchMeta aggregation stages use inter…

securityFixes CVE-2026-13063: An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted aggregation command. MongoDB's libmongocry…

securityFixes CVE-2026-13068: An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for…

8.2.11 Jun 16, 2026 Release notes ↗

securityFixes CVE-2026-11933: A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated user with read privileges who is able t…

8.2.10 Jun 16, 2026 Release notes ↗

securityFixes CVE-2026-9753: The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bounds or crash the server. $_internalApp…

securityFixes CVE-2026-9740: A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod process by sending a specially crafted message. The BSON validator's handling of certain…

securityFixes CVE-2026-9742: When OIDC authentication is enabled in configuration, clients may set specific values in the "mechanism" parameter of the "authenticate" command that lead to server crash. The authenticate command…

securityFixes CVE-2026-9754: An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command

securityFixes CVE-2026-9747: Adding fromRouter:true and runtimeConstants.userRoles could cause aggregations to crash mongodb server.

securityFixes CVE-2026-9748: The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index stats conversion failed. But PauseExecution is not a general purpose skip mecha…

securityFixes CVE-2026-9749: This issue can occur when running an aggregation pipeline that uses the internal $exchange stage configured with key-range partitioning and order-preserving delivery. If a single key range produces…

securityFixes CVE-2026-9750: An authenticated user can cause a MongoDB server to crash or return incorrect results by creating documents that interfere with internal metadata processing during query execution. This stems from…

securityFixes CVE-2026-9752: An authorized user could trigger a server crash by running a query with a 2dsphere index on a field that stores a GeoJSON GeometryCollection containing a Polygon with a strict-winding CRS. Strict-…

securityFixes CVE-2026-9741: A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE) results in literal values for encrypted fields…

securityFixes CVE-2026-9746: When using $changestreams and $_requestReshardingResumeToken with the exchange option the server hits an invariant which causes the server to crash. There are no special privileges needed. The user…

securityFixes CVE-2026-9751: The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mongod.log file in plain text.

8.2.9 May 13, 2026 Release notes ↗

securityFixes CVE-2026-8053: An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds memory write in the mongod process. The is…

8.2.7 May 5, 2026 Release notes ↗

securityFixes CVE-2026-8063: An authenticated user can crash mongod when running $rankFusion or $scoreFusion with an empty pipeline on a view. When resolving a view, the server inspects the aggregation pipeline to determine w…

securityFixes CVE-2026-6914: Computing the MD5 checksum of a malformed BSON object under specific conditions may cause loss of availability in MongoDB server. This issue affects all MongoDB Server v8.2 versions, all MongoDB Se…

securityFixes CVE-2026-6915: An authorization flaw in the user management command could allow an authenticated user to make limited changes to authentication-related data associated with another user account. This could affect…

8.2.6 Mar 18, 2026 Release notes ↗

securityFixes CVE-2026-4148: A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who issues a specially crafted $lookup or $graphLookup aggregation pipeline.

securityFixes CVE-2026-8843: Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server. A si…

securityFixes CVE-2026-4147: An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command.

securityFixes CVE-2026-4358: A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-free or use-after-free memory issue in the slot-based execution (SBE) engine whe…

8.2.5 Feb 10, 2026 Release notes ↗

8.2.4 Feb 10, 2026 Release notes ↗

securityFixes CVE-2026-1848: Connections received from the proxy port may not count towards total accepted connections, resulting in server crashes if the total number of connections exceeds available resources. This only appl…

securityFixes CVE-2026-25613: An authorized user may disable the MongoDB server by issuing a query against a collection that contains an invalid compound wildcard index.

securityFixes CVE-2026-1847: Inserting certain large documents into a replica set could lead to replica set secondaries not being able to fetch the oplog from the primary. This could stall replication inside the replica set le…

securityFixes CVE-2026-1850: Complex queries can cause excessive memory usage in MongoDB Query Planner resulting in an Out-Of-Memory Crash.

securityFixes CVE-2026-25609: Incorrect validation of the profile command may result in the determination that a request altering the 'filter' is read-only.

8.2.3 Dec 22, 2025 Release notes ↗

securityFixes CVE-2025-14847: Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 v…

8.2.2 Oct 30, 2025 Release notes ↗

securityFixes CVE-2026-1849: MongoDB Server may experience an out-of-memory failure while evaluating expressions that produce deeply nested documents. The issue arises in recursive functions because the server does not periodi…

securityFixes CVE-2026-5170: A user with access to the cluster with a limited set of privilege actions can trigger a crash of a mongod process during the limited and unpredictable window when the cluster is being promoted from…

securityFixes CVE-2025-14345: A post-authentication flaw in the network two-phase commit protocol used for cross-shard transactions in MongoDB Server may lead to logical data inconsistencies under specific conditions which are…

securityFixes CVE-2025-12893: Clients may successfully perform a TLS handshake with a MongoDB server despite presenting a client certificate not aligning with the documented Extended Key Usage (EKU) requirements. A certificate…

8.2.1 Sep 30, 2025 Release notes ↗

securityFixes CVE-2025-13507: Inconsistent object size validation in time series processing logic may result in later processing of oversized BSON documents leading to an assert failing and process termination. This issue impa…

8.2.0 Aug 15, 2025 Release notes ↗

8.1.3 Aug 8, 2025 Release notes ↗

8.1.2 Jul 1, 2025 Release notes ↗

securityFixes CVE-2025-13644: MongoDB Server may experience an invariant failure during batched delete operations when handling documents. The issue arises when the server mistakenly assumes the presence of multiple documents i…

securityFixes CVE-2025-10061: An authorized user can cause a crash in the MongoDB Server through a specially crafted $group query. This vulnerability is related to the incorrect handling of certain accumulator functions when ad…

8.1.1 May 27, 2025 Release notes ↗

8.1.0 May 27, 2025 Release notes ↗

8.0.34 Oct 13, 2026 Release notes ↗

securityCVE-2026-96297

securityCVE-2026-103965

securityCVE-2026-104004

otherSERVER-132946 Heap-use-after-free in $_internalApplyOplogUpdate stage when reading via getMore after aggregate Invocation is destroyed

otherSERVER-134618 Fix serialization of constant values in $bucket stage

otherSERVER-131412 Improve Validation Expression

otherSERVER-79980 Support TLS 1.3 for Windows

otherSERVER-98105 Pause drop pending ident reaper until backup cursor is closed

otherWT-18353 Checkpoint panics when a file's metadata predates the checkpoint_backup_info field

otherAll JIRA issues closed in 8.0.34

other8.0.34 Changelog

8.0.32 Sep 11, 2026 Release notes ↗

securityCVE-2026-89099

otherSERVER-134063 Shred collection validator constants during parsing

otherAll JIRA issues closed in 8.0.32

8.0.30 Sep 8, 2026 Release notes ↗

securityCVE-2026-82056

securityCVE-2026-82054

securityCVE-2026-82053

securityCVE-2026-82076

securityCVE-2026-82075

securityCVE-2026-82074

securityCVE-2026-82071

securityCVE-2026-82070

securityCVE-2026-82068

securityCVE-2026-82067

securityCVE-2026-82066

securityCVE-2026-82065

securityCVE-2026-82064

securityCVE-2026-82063

securityCVE-2026-82060

securityCVE-2026-82052

securityCVE-2026-82059

securityCVE-2026-82058

otherSERVER-90889 Check timeseries collections throught the checkMetadataConsistency command

otherSERVER-108215 Impose limits on the number of active multi-document transactions

otherSERVER-110952 Creation of untracked legacy timeseries collection may release DDL lock mid-creation due to unknown shard version

otherSERVER-125742 Remove the graceful exit for kernel version 7.0.14 and above

otherSERVER-132246 minWaitForStreamingHelloMillis default breaks spec-compliant drivers

otherSERVER-130571 Limit use of $_internalIndexKey to internal clients only

otherSERVER-130926 Usage of strtoll in generateJSONSchemaArraySingleSchemaError can throw std::exception

otherSERVER-130901 Limit JSON Pointer path depth to 255 for $jsonSchema.encryptMetadata.keyId

otherSERVER-130785 Fix LDAP roles for pooled LDAP connections

securitySERVER-128253 Integer overflow in query planner explodeForSort() can trigger mongod denial of service

otherSERVER-132650 Make mongos use the configurable minimum timeout for pre-auth streamable hello

otherSERVER-132275 [v8.0] Reject $lookup with multiple pipeline arguments

otherSERVER-131860 Improve wiredtiger config string handling

otherSERVER-131423 Apply consistent redaction in reportState()

fixSERVER-131326 Repeat stmtIds on writes crash the server

otherSERVER-131229 enforce case-sensitivity in options validation

otherSERVER-131562 Heap memory disclosure via mis-indexed tie-break vectors in the query multi-planner

otherSERVER-131420 Reject WiredTiger configString type overrides other than "type=file"

otherSERVER-130759 Adjust invariant condition to account for arbiter nodes

otherSERVER-131870 Fix heap use-after-free

otherSERVER-131202 Fix aggregation pipeline updateLookup with dollar-prefixed fields

otherSERVER-127985 Reject regex matches that do not lay on UTF-8 character boundaries

+3 more items in the release notes

8.0.29 Aug 11, 2026 Release notes ↗

securityFixes CVE-2026-18692: An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory ha…

securityFixes CVE-2026-82070: A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected credentials from concurrent administra…

securityFixes CVE-2026-18707: An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to terminate unexpectedly by submitting a specially formed aggre…

securityCVE-2026-18687

securityCVE-2026-18688

securityCVE-2026-18690

securityCVE-2026-18691

securityCVE-2026-18693

securityCVE-2026-18694

securityCVE-2026-18695

securityCVE-2026-18696

securityCVE-2026-18697

securityCVE-2026-18698

securityCVE-2026-18699

securityCVE-2026-18700

securityCVE-2026-18701

securityCVE-2026-18702

securityCVE-2026-18705

securityCVE-2026-18708

securityCVE-2026-18709

securityCVE-2026-18711

securityCVE-2026-18712

otherSERVER-117395 Avoid reading target node multiple times in $addToSet with arrays

featureSERVER-118763 Add severity levels for checkMetadataConsistency command results

otherSERVER-128392 Duplicate insert into a clustered collection whose _id contains a Decimal128 throws a KeyString format error

otherSERVER-129460 Ensure valid jsonSchema in time series updates

otherSERVER-129617 Better validation for NaN in $percentile and $median

otherSERVER-129618 Disallow user-provided $vectorSearch arguments from overriding internally generated options

fixSERVER-129994 Fix a malformed FlatBSON store caused by inserting duplicate field names

otherSERVER-130110 Gate the internal-only _internalSetObjToThis field of $function behind an internal-client check

otherSERVER-130111 Prevent invalid type conversion during match expression serialization

fixSERVER-130117 Fix a heap use-after-free in collection validation for big polygons

otherSERVER-130139 Account for the o-versus-UUID consistency check

otherSERVER-130167 Stop the JavaScript scope from constructing delete requests by concatenating unsanitized _id fields

otherSERVER-130188 Exclude partial indexes from 2dsphere geometry skip-validation

otherSERVER-130198 Increase the authorization requirement for slowms and sampleRate in the profile command

otherSERVER-130247 Treat Decimal128 values as potentially invalid when preparing to yield or detach a cursor

otherSERVER-130264 Apply the intra-cluster SASL mechanism allowlist in egress connection setup

otherSERVER-130266 Prohibit $text and $near in $_internalSchemaCond

featureSERVER-130481 Allow the symbol type in CommandHelpers::parseNsFromCommand

+5 more items in the release notes

8.0.28 Jul 28, 2026 Release notes ↗

securityCVE-2026-9737

securityCVE-2026-13055

securityCVE-2026-13056

securityCVE-2026-13057

securityCVE-2026-13058

securityCVE-2026-13059

securityCVE-2026-13060

securityCVE-2026-13061

securityCVE-2026-13062

securityCVE-2026-13064

securityCVE-2026-13065

securityCVE-2026-13066

securityCVE-2026-13067

securityCVE-2026-13068

securityCVE-2026-13069

securityCVE-2026-13070

securityCVE-2026-13071

securityCVE-2026-13072

securityCVE-2026-13073

securityCVE-2026-13074

securityCVE-2026-13077

securityCVE-2026-13078

otherSERVER-123081 Handle compound wildcard index spec in $_internalIndexKey

otherSERVER-124355 Improve memory checks for array expressions to prevent huge in-memory arrays from $concatArrays combined with $range

otherSERVER-125872 Fix exponential hashing of query solutions for InternalSchema*MatchExpression nodes

otherSERVER-126247 Properly validate $search.mergingPipeline as an internal-only field

otherSERVER-127280 Reject expression-based sortBy in the $linearFill parser

otherSERVER-127357 Check for duplicate from fields in DocumentSourceGraphLookup::createFromBson()

otherSERVER-127566 Limit the contention factor that can be used for FLE2 fields

otherSERVER-127661 Require autocommit when startOrContinueTransaction is specified

featureSERVER-127689 Only allow internal clients to specify $_internalPredicate

featureSERVER-127694 Add type checking for DBPointer

otherSERVER-127831 Forbid external users from running FLE2 commands with crudProcessed set to true

otherSERVER-128198 Fix mongos killCursors to check authorization against the cursor's namespace instead of the request namespace

fixSERVER-128341 Fix a server crash caused by sorting on a $meta expression

otherSERVER-129103 Restrict target BinData subtypes in $convert and $constant/$literal

featureSERVER-128362 Add a null check on the return value in ocspClientCallback

fixSERVER-128473 Fix a use-after-free in $function caused by a missing advanceGeneration() call on retained BSON arguments

featureSERVER-128517 Add a configurable minimum timeout for pre-auth streamable hello to prevent a hot loop from very small maxAwaitTimeMS values

fixSERVER-112273 Killing an OplogWriter operation using killOp() results in a crash

+11 more items in the release notes

8.0.26 Jun 16, 2026 Release notes ↗

securityMongoDB 8.0.26 contains a fix for CVE-2026-11933

otherSERVER-128125 Align bsonObjToArray ownership semantics with bsonGetImmutable

otherAll JIRA issues closed in 8.0.26

other8.0.26 Changelog

8.0.25 Jun 16, 2026 Release notes ↗

otherSERVER-127984 Speed up isMetadataFieldName with compile-time field matching

other8.0.25 Changelog

8.0.24 Jun 16, 2026 Release notes ↗

securityCVE-2026-9740

securityCVE-2026-9741

securityCVE-2026-9743

securityCVE-2026-9746

securityCVE-2026-9747

securityCVE-2026-9748

securityCVE-2026-9749

securityCVE-2026-9750

securityCVE-2026-9751

securityCVE-2026-9752

securityCVE-2026-9753

otherSERVER-106903 Make QueryAnalysisCoordinator::onSamplerDelete less error prone

otherSERVER-107966 A SingleServerPingMonitor within the RSM can get disabled and never reenabled

otherSERVER-115250 Pause JWKSetRefreshJob during quiesce time

otherSERVER-121822 Clustered collections do not correctly filter out results with $lt on _id

otherSERVER-126049 MozJS per-scope heap limit check uses process-global GC counter

otherSERVER-125063 Prohibit nesting of BSONColumn inside BSONColumn

otherSERVER-123507 Encrypted predicates inside a $vectorSearch prefilter should get replaced with encryption placeholders

featureSERVER-123688 Add null check in DocumentSourceSetVariableFromSubPipeline::reattachToOperationContext()

otherSERVER-124190 Forbid aggregate exchange field from non-internal clients

otherSERVER-123918 Validate runtimeConstants.userRoles in IDL

otherSERVER-123951 $_internalConvertBucketIndexStats should not return PauseExecution on failed index conversion

otherSERVER-124031 Ensure Exchange::getTargetConsumer correctly handles MaxKey

otherSERVER-123633 Fix handling of user $-prefixed fields colliding with internal metadata

otherSERVER-123370 LDAP query password is logged when set through setParameter

fixSERVER-123440 GeometryCollection with strict-winding polygon causes 2dsphere index key generation crash

otherSERVER-124959 Validate doc diff array bounds and $_internalApplyOplogUpdate BSON

otherAll JIRA issues closed in 8.0.24

other8.0.24 Changelog

8.0.23 May 13, 2026 Release notes ↗

securityCVE-2026-8053

securityCVE-2026-8199

securityCVE-2026-8200

securityCVE-2026-8201

securityCVE-2026-8202

otherSERVER-120668 Disallow $trim with too large mask string

otherSERVER-121895 Improve redaction of validation errors

otherSERVER-122032 Calling replaceEncryptedFieldsInFilter with positional projection results in use-after-free

otherSERVER-122449 Improve $bitSet match expressions

otherSERVER-126021 Undefined behavior when inserting data with duplicate field names into timeseries collections

otherAll JIRA issues closed in 8.0.23

other8.0.23 Changelog

8.0.21 Apr 30, 2026 Release notes ↗

securityCVE-2026-6914

securityCVE-2026-6915

otherSERVER-119679 Missing Authorization Check in updateUser

deprecatedSERVER-119981 Fix binDataClean() for deprecated type

otherSERVER-86326: Increase max regex pattern length to 32k

otherSERVER-104438: Reclaiming oplog may block stepup/stepdown

otherSERVER-111007: Validation should distinguish between root causes when finding mixed schema data

otherSERVER-118466: Prevent the TTL Monitor from spawning an unbounded amount of threads for sharding metadata recovery

otherSERVER-118546: Can not create timeseries 2dsphere index with a non-system user

otherAll JIRA issues closed in 8.0.21

other8.0.21 Changelog

8.0.20 Mar 17, 2026 Release notes ↗

securityCVE-2026-4147

securityCVE-2026-4148

otherSERVER-105047: Query using $or and $ne on sharded collection can include orphan documents

otherSERVER-110423: $group can use a distinct scan on a sparse index, which hides null/missing results

otherSERVER-110803: $top and $bottom ignore sortBy clause when preceding $sort stage makes it eligible for DISTINCT_SCAN optimization

otherSERVER-110832: OplogWriter should not hold on to session through rollbacks

otherSERVER-110916: Use-after-move in targetShardsAndAddMergeCursors()

otherSERVER-113319: $match pushdown past a renamed field is done incorrectly when the expression root is a renamed field path expression

otherSERVER-115962: Balancer does not make progress when the most loaded shard is already balanced within its zones

otherSERVER-118428: mongocryptd rejects large messages

otherSERVER-119317: Improve object lifecycle of MD5 hash state

fixSERVER-119319: Fix ExpressionContext use-after-free bug

fixWT-14034: Fix resolving the prepared key multiple times because of reserved updates

otherAll JIRA issues closed in 8.0.20

other8.0.20 Changelog

8.0.19 Feb 10, 2026 Release notes ↗

otherSERVER-118712 - Can not create timeseries 2dsphere index with a non-system user

otherAll JIRA issues closed in 8.0.19

other8.0.19 Changelog

8.0.18 Feb 10, 2026 Release notes ↗

securityCVE-2026-1847

securityCVE-2026-1848

securityCVE-2026-1849

securityCVE-2026-1850

securityCVE-2026-25609

securityCVE-2026-25611

securityCVE-2026-25612

securityCVE-2026-25613

otherSERVER-102364 - Periodically check $reduce accumulated depth less than maxAllowableBSONDepth

otherSERVER-103774 - Disallow compound wildcard indexes from being used as a shard key index

otherSERVER-110953 - Check no orphaned document is present on a recipient shard before starting cloning a range

otherSERVER-112952 - tighten profile command auth check

featureSERVER-113532 - [8.0] Introduce a new CursorResponseBsonSize limit of 16MB+32KB

otherSERVER-113685 - Segfault for query on compound wildcard index

featureSERVER-114126 - Reduce memory usage and add new guardrails to the boolean simplifier

otherSERVER-114695 - Update default value for pending connections

otherSERVER-114838 - Lock Manager is susceptible to an adversarial DDOS attack

otherSERVER-115296 - Redact ResourceId raw values from error messages

otherSERVER-116206 - Better exception handling for message compressors

otherSERVER-116210 - Adjust the maximum buffer size for ingress requests

otherSERVER-116211 - Cap memory allocated by network buffers

otherAll JIRA issues closed in 8.0.18

other8.0.18 Changelog

8.0.17 Dec 22, 2025 Release notes ↗

securityMongoDB 8.0.17 contains a fix for CVE-2025-14847.

otherSERVER-115508: Make minimally sized buffers for uncompressed Messages

other8.0.17 Changelog

8.0.16 Oct 30, 2025 Release notes ↗

securityMongoDB 8.0.16 includes fixes for CVE-2025-12893, CVE-2025-13507, and CVE-2025-14345.

otherSERVER-55068: Sets the net.maxIncomingConnections maximum on Linux systems to (RLIMIT_NOFILE / 2) * 0.8

fixSERVER-82688: Fixes a bug that caused mongod to crash, when the number of connections exceeded WiredTiger's session_max limit

otherSERVER-95374: Resolves an issue where compound wildcard indexes could push predicates down incorrectly during union or query planning

featureSERVER-103960: Implements a proper validation check to the field path to ensure the number of parts does not exceed 255

otherSERVER-108565: Improve handling of oversized writes to time series collections.

otherSERVER-112467: Improves tracking and reporting of the number of pending proxy connections

fixSERVER-112520: Fixes a failure to write to a geo index when inserting a document into an existing bucket in a time series collection

fixWT-9575: Fixes an issue where pages with updates newer than the oldest transaction ID were not queued for eviction

fixWT-15225: Fixes an EBUSY issue for newly created tables and drop() operations

otherAll JIRA issues closed in 8.0.16

other8.0.16 Changelog

8.0.15 Oct 21, 2025 Release notes ↗

securityFixes CVE-2025-11979: An authorized user may crash the MongoDB server by causing buffer over-read. This can be done by issuing a DDL operation while queries are being issued, under some conditions. This issue affects Mo…

otherSERVER-105873: QueryPlannerParams should not maintain pointers owned by IndexCatalogEntry

otherAll JIRA issues closed in 8.0.15

other8.0.15 Changelog

8.0.14 Sep 15, 2025 Release notes ↗

securityMongoDB 8.0.14 includes a fix for CVE-2025-13643.

otherSERVER-100448: Command registration should not depend on the FCV at startup

otherSERVER-103742: opWriteConcernCounters can illegally embed a NUL bytes into ServerStatus

otherSERVER-103841: Memory leak in TransactionCoordinator associated to long-lived cancellation source

otherSERVER-105478: Separate eligible and ineligible oplog entries for the applier with secondaryDelaySecs

otherWT-14140: Unnecessary schema lock taken for active "file:" dhandles that are not swept

featureWT-14653: Add logs/stats to reconciliation for tracking HS updates

otherAll JIRA issues closed in 8.0.14

other8.0.14 Changelog

8.0.13 Aug 14, 2025 Release notes ↗

securityFixes CVE-2026-25610: An authorized user may trigger a server crash by running a $geoNear pipeline with certain invalid index hints.

securityMongoDB 8.0.13 includes a fix for CVE-2025-13644.

otherSERVER-77172: abortExpiredTransactions thread can get stuck if it fails to checkout a session

otherSERVER-82180: Capped inserts on the primary can have a different natural ordering from secondaries

otherSERVER-91686: Improve mongod signal handler to print out current thread's command object

fixSERVER-94315: Shard filtering bug with collation

otherSERVER-102670: Incorrect ordered time-series insert error handling

otherSERVER-107361: Rollover determination in the bucket catalog can fail to check mixed schema for large measurements

otherAll JIRA issues closed in 8.0.13

other8.0.13 Changelog

otherSERVER-103927: Changes how the server gets built by using Bazel instead of SCons

8.0.12 Jul 17, 2025 Release notes ↗

securityFixes CVE-2025-10060: MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure and server crash during commit. This issue may…

8.0.11 Jun 30, 2025 Release notes ↗

8.0.10 May 28, 2025 Release notes ↗

securityFixes CVE-2025-6712: MongoDB Server may be susceptible to disruption caused by high memory usage, potentially leading to server crash. This condition is linked to inefficiencies in memory management related to internal…

securityFixes CVE-2025-12657: The KMIP response parser built into mongo binaries is overly tolerant of certain malformed packets, and may parse them into invalid objects. Later reads of this object can result in read access vio…

8.0.9 May 13, 2025 Release notes ↗

securityFixes CVE-2025-6714: MongoDB Server's mongos component can become unresponsive to new connections due to incorrect handling of incomplete data. This affects MongoDB when configured with load balancer support. This issu…

8.0.8 Apr 24, 2025 Release notes ↗

8.0.7 Apr 23, 2025 Release notes ↗

securityFixes CVE-2025-6713: An unauthorized user may leverage a specially crafted aggregation pipeline to access data without proper authorization due to improper handling of the $mergeCursors stage in MongoDB Server. This ma…

8.0.6 Apr 9, 2025 Release notes ↗

securityFixes CVE-2025-10059: An improper setting of the lsid field on any sharded query can cause a crash in MongoDB routers. This issue occurs when a generic argument (lsid) is provided in a case when it is not applicable. Th…

8.0.5 Apr 9, 2025 Release notes ↗

securityFixes CVE-2025-6709: The MongoDB Server is susceptible to a denial of service vulnerability due to improper handling of specific date values in JSON input when using OIDC authentication. This can be reproduced using th…

securityFixes CVE-2025-6710: MongoDB Server may be susceptible to stack overflow due to JSON parsing mechanism, where specifically crafted JSON inputs may induce unwarranted levels of recursion, resulting in excessive stack sp…

securityFixes CVE-2025-6711: An issue has been identified in MongoDB Server where unredacted queries may inadvertently appear in server logs when certain error conditions are encountered. This issue affects MongoDB Server v8.0…

securityFixes CVE-2025-6707: Under certain conditions, an authenticated user request may execute with stale privileges following an intentional change by an authorized administrator. This issue affects MongoDB Server v5.0 vers…

8.0.4 Nov 27, 2024 Release notes ↗

securityFixes CVE-2025-3085: A MongoDB server under specific conditions running on Linux with TLS and CRL revocation status checking enabled, fails to check the revocation status of the intermediate certificates in the peer's…

securityFixes CVE-2025-3084: When run on commands with certain arguments set, explain may fail to validate these arguments before using them. This can lead to crashes in router servers. This affects MongoDB Server v5.0 prior t…

securityFixes CVE-2025-6706: An authenticated user may trigger a use after free that may result in MongoDB Server crash and other unexpected behavior, even if the user does not have authorization to shut down a server. The cra…

8.0.3 Nov 19, 2024 Release notes ↗

securityFixes CVE-2024-10921: An authorized user may trigger crashes or receive the contents of buffer over-reads of Server memory by issuing specially crafted requests that construct malformed BSON in the MongoDB Server. This…

8.0.2 Nov 19, 2024 Release notes ↗

8.0.1 Oct 3, 2024 Release notes ↗

8.0.0 Sep 11, 2024 Release notes ↗

7.3.4 Aug 14, 2024 Release notes ↗

securityFixes CVE-2024-8305: prepareUnique index may cause secondaries to crash due to incorrect enforcement of index constraints on secondaries, where in extreme cases may cause multiple secondaries crashing leading to no pri…

securityFixes CVE-2025-3082: A user authorized to access a view may be able to alter the intended collation, allowing them to access to a different or unintended view of underlying data. This issue affects MongoDB Server v5.0…

7.3.3 Jun 11, 2024 Release notes ↗

securityFixes CVE-2024-7553: Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executi…

securityFixes CVE-2024-6384: "Hot" backup files may be downloaded by underprivileged users, if they are capable of acquiring a unique backup identifier. This issue affects MongoDB Enterprise Server v6.0 versions prior to 6.0.1…

7.3.2 Apr 29, 2024 Release notes ↗

7.3.1 Apr 4, 2024 Release notes ↗

7.3.0 Mar 19, 2024 Release notes ↗

7.2.2 Feb 28, 2024 Release notes ↗

7.2.1 Feb 21, 2024 Release notes ↗

7.2.0 Dec 14, 2023 Release notes ↗

7.1.1 Nov 16, 2023 Release notes ↗

7.1.0 Oct 4, 2023 Release notes ↗

7.0.45 Oct 13, 2026 Release notes ↗

securityCVE-2026-96297

securityCVE-2026-103965

otherSERVER-132946 Heap-use-after-free in $_internalApplyOplogUpdate stage when reading via getMore after aggregate Invocation is destroyed

otherSERVER-134618 Fix serialization of constant values in $bucket stage

otherSERVER-104343 unsupportedSyncSource server parameter can cause invariant

otherSERVER-107966 A SingleServerPingMonitor within the RSM can get disabled and never reenabled

otherSERVER-119766 Fix data race in oplogFetcherHighestFetchedOptime metric

otherSERVER-128392 Duplicate insert into a clustered collection whose _id contains a Decimal128 throws a KeyString format error

otherSERVER-132246 minWaitForStreamingHelloMillis default breaks spec-compliant drivers

otherAll JIRA issues closed in 7.0.45

other7.0.45 Changelog

7.0.43 Sep 11, 2026 Release notes ↗

securityCVE-2026-89099

otherSERVER-134063 Shred collection validator constants during parsing

otherAll JIRA issues closed in 7.0.43

7.0.41 Sep 8, 2026 Release notes ↗

securityFixes CVE-2026-82056: A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert retry paths. Under certain concurrent index lifecycle operations, a raw point…

securityCVE-2026-82054

securityCVE-2026-82053

securityCVE-2026-82076

securityCVE-2026-82075

securityCVE-2026-82074

securityCVE-2026-82071

securityCVE-2026-82070

securityCVE-2026-82068

securityCVE-2026-82067

securityCVE-2026-82066

securityCVE-2026-82065

securityCVE-2026-82064

securityCVE-2026-82063

securityCVE-2026-82060

securityCVE-2026-82052

securityCVE-2026-82059

securityCVE-2026-82058

otherSERVER-104464 Handle missing index idents during replica set startup recovery after unclean shutdown

featureSERVER-111573 Add configuration to collstats to return full wiredtiger data source metrics

otherSERVER-111885 Index Build Merging Spills conflicts with replSetGetStatus

otherSERVER-127346 Make session refresh have kExempt admission priority