MongoDB 8.2.11 → 8.3.2

Breaking changes

None in the release notes.

Security changes

• security Fixes CVE-2026-8336: After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subsequently crash mongod when the… in 8.3.2
• security Fixes CVE-2026-8199: An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear. This contributes to memory pressure an… in 8.3.2
• security Fixes CVE-2026-8201: A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared. Triggering this vulnerability r… in 8.3.2
• security Fixes CVE-2026-8202: Using a densely populated chars mask and a large input string in the MongoDB aggregation operators $trim, $ltrim, and $rtrim, an authenticated user with aggregation permissions can pin CPU utilizat… in 8.3.2
• security Fixes CVE-2026-8200: When schema validation is enabled on a collection and an update or insert would violate the collection's schema, the local server log message generated may not have all user data redacted.  This… in 8.3.2
• security MongoDB 8.3.2 contains a fix for CVE-2026-8053 in 8.3.2
• security CVE-2026-8199 in 8.3.1
• security CVE-2026-8200 in 8.3.1
• security CVE-2026-8201 in 8.3.1
• security CVE-2026-8202 in 8.3.1
• security CVE-2026-8336 in 8.3.1
• security MongoDB 8.3 includes fixes for CVE-2025-12893, CVE-2025-13507, CVE-2025-14345, and CVE-2026-8336, CVE-2026-9754. in 8.3.0
• security For the latest information about MongoDB security updates, see MongoDB Security Bulletins. in 8.3.0
• security Fixes CVE-2026-13072: When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potenti… in 8.2.12
• security Fixes CVE-2026-13059: An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain… in 8.2.12
• security Fixes CVE-2026-13078: A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files… in 8.2.12
• security Fixes CVE-2026-13077: A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an… in 8.2.12
• security Fixes CVE-2026-13075: An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The issue originates in th… in 8.2.12
• security Fixes CVE-2026-13069: An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used… in 8.2.12
• security Fixes CVE-2026-13071: An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory… in 8.2.12
• security Fixes CVE-2026-13062: An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by send… in 8.2.12
• security Fixes CVE-2026-13064: Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading to resource exhaustion. The… in 8.2.12
• security Fixes CVE-2026-13065: A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to termin… in 8.2.12
• security Fixes CVE-2026-13066: Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the cli… in 8.2.12
• security Fixes CVE-2026-13055: The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle compound wildcard index specifications, trig… in 8.2.12
• security Fixes CVE-2026-13058: An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomplete set of required fields. The issue… in 8.2.12
• security Fixes CVE-2026-13060: An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stag… in 8.2.12
• security Fixes CVE-2026-13074: An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's… in 8.2.12
• security Fixes CVE-2026-13070: A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCSP stapling validation is en… in 8.2.12
• security Fixes CVE-2026-13057: An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user access controls. In sharded topologies, the $search and $searchMeta aggregation stages use inter… in 8.2.12
• security Fixes CVE-2026-13063: An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted aggregation command. MongoDB's libmongocry… in 8.2.12
• security Fixes CVE-2026-13068: An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for… in 8.2.12

Every release in between