MongoDB 8.2.11 → 8.3.7

Vulnerabilities fixed by this upgrade

• 6.5 CVE-2026-9737 During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case. This may lead to incorrect transformations leading to in…
• 5.3 CVE-2026-13074 An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's…
• 6.5 CVE-2026-13075 An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The issue originates in th…
• 7.1 CVE-2026-13077 A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an…
• 7.7 CVE-2026-13078 A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files…
• 4.2 CVE-2026-13068 An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for…
• 6.5 CVE-2026-13069 An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used…
• 5.3 CVE-2026-13070 A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCSP stapling validation is en…
• 6.5 CVE-2026-13071 An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory…
• 8.1 CVE-2026-13072 When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potenti…
• 6.5 CVE-2026-13062 An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by send…
• 4.3 CVE-2026-13063 An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted aggregation command. MongoDB's libmongocry…
• 6.5 CVE-2026-13064 Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading to resource exhaustion. The…
• 6.5 CVE-2026-13065 A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to termin…
• 6.5 CVE-2026-13066 Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the cli…
• 6.5 CVE-2026-13055 The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle compound wildcard index specifications, trig…
• 5.3 CVE-2026-13057 An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user access controls. In sharded topologies, the $search and $searchMeta aggregation stages use inter…
• 6.5 CVE-2026-13058 An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomplete set of required fields. The issue…
• 8.1 CVE-2026-13059 An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain…
• 6.5 CVE-2026-13060 An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stag…

Breaking changes

None in the release notes.

Security changes

• security CVE-2026-9737 in 8.3.7
• security CVE-2026-13055 in 8.3.7
• security CVE-2026-13056 in 8.3.7
• security CVE-2026-13057 in 8.3.7
• security CVE-2026-13058 in 8.3.7
• security CVE-2026-13059 in 8.3.7
• security CVE-2026-13060 in 8.3.7
• security CVE-2026-13061 in 8.3.7
• security CVE-2026-13062 in 8.3.7
• security CVE-2026-13063 in 8.3.7
• security CVE-2026-13064 in 8.3.7
• security CVE-2026-13065 in 8.3.7
• security CVE-2026-13066 in 8.3.7
• security CVE-2026-13067 in 8.3.7
• security CVE-2026-13068 in 8.3.7
• security CVE-2026-13069 in 8.3.7
• security CVE-2026-13070 in 8.3.7
• security CVE-2026-13071 in 8.3.7
• security CVE-2026-13072 in 8.3.7
• security CVE-2026-13074 in 8.3.7
• security CVE-2026-13075 in 8.3.7
• security CVE-2026-13076 in 8.3.7
• security CVE-2026-13077 in 8.3.7
• security CVE-2026-13078 in 8.3.7
• security MongoDB 8.3.4 contains a fix for CVE-2026-11933 in 8.3.4
• security Fixes CVE-2026-9754: An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command in 8.3.3
• security CVE-2026-9735 in 8.3.3
• security CVE-2026-9740 in 8.3.3
• security CVE-2026-9741 in 8.3.3
• security CVE-2026-9742 in 8.3.3
• security CVE-2026-9746 in 8.3.3
• security CVE-2026-9747 in 8.3.3
• security CVE-2026-9748 in 8.3.3
• security CVE-2026-9749 in 8.3.3
• security CVE-2026-9750 in 8.3.3
• security CVE-2026-9751 in 8.3.3
• security CVE-2026-9752 in 8.3.3
• security CVE-2026-9753 in 8.3.3
• security Fixes CVE-2026-8336: After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subsequently crash mongod when the… in 8.3.2
• security Fixes CVE-2026-8199: An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear. This contributes to memory pressure an… in 8.3.2
• security Fixes CVE-2026-8201: A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared. Triggering this vulnerability r… in 8.3.2
• security Fixes CVE-2026-8202: Using a densely populated chars mask and a large input string in the MongoDB aggregation operators $trim, $ltrim, and $rtrim, an authenticated user with aggregation permissions can pin CPU utilizat… in 8.3.2
• security Fixes CVE-2026-8200: When schema validation is enabled on a collection and an update or insert would violate the collection's schema, the local server log message generated may not have all user data redacted.  This… in 8.3.2
• security MongoDB 8.3.2 contains a fix for CVE-2026-8053 in 8.3.2
• security CVE-2026-8199 in 8.3.1
• security CVE-2026-8200 in 8.3.1
• security CVE-2026-8201 in 8.3.1
• security CVE-2026-8202 in 8.3.1
• security CVE-2026-8336 in 8.3.1
• security MongoDB 8.3 includes fixes for CVE-2025-12893, CVE-2025-13507, CVE-2025-14345, and CVE-2026-8336, CVE-2026-9754. in 8.3.0
• security For the latest information about MongoDB security updates, see MongoDB Security Bulletins. in 8.3.0
• security Fixes CVE-2026-13072: When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potenti… in 8.2.12
• security Fixes CVE-2026-13059: An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain… in 8.2.12
• security Fixes CVE-2026-13078: A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files… in 8.2.12
• security Fixes CVE-2026-13077: A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an… in 8.2.12
• security Fixes CVE-2026-13075: An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The issue originates in th… in 8.2.12
• security Fixes CVE-2026-13069: An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used… in 8.2.12
• security Fixes CVE-2026-13071: An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory… in 8.2.12
• security Fixes CVE-2026-13062: An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by send… in 8.2.12
• security Fixes CVE-2026-13064: Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading to resource exhaustion. The… in 8.2.12
• security Fixes CVE-2026-13065: A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to termin… in 8.2.12
• security Fixes CVE-2026-13066: Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the cli… in 8.2.12
• security Fixes CVE-2026-13055: The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle compound wildcard index specifications, trig… in 8.2.12
• security Fixes CVE-2026-13058: An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomplete set of required fields. The issue… in 8.2.12
• security Fixes CVE-2026-13060: An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stag… in 8.2.12
• security Fixes CVE-2026-13074: An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's… in 8.2.12
• security Fixes CVE-2026-13070: A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCSP stapling validation is en… in 8.2.12
• security Fixes CVE-2026-13057: An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user access controls. In sharded topologies, the $search and $searchMeta aggregation stages use inter… in 8.2.12
• security Fixes CVE-2026-13063: An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted aggregation command. MongoDB's libmongocry… in 8.2.12
• security Fixes CVE-2026-13068: An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for… in 8.2.12

Every release in between