MongoDB 8.2.11 → 8.3.9

9 releases · 0 breaking changes · 119 security fixes · 46 advisories fixed

119security0breaking0deprecated10feature26fix

Is 8.2.11 affected? · What changed up to 9.0.4

Vulnerabilities fixed by this upgrade

6.5 CVE-2026-82070 A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected credentials from concurrent administra…
6.5 CVE-2026-82076 An integer overflow in the query planning component of MongoDB Server can allow an authenticated user with ordinary database-level read/write privileges to bypass an internal resource limit. Submit…
8.1 CVE-2026-82053 A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authentication under certain configurations.…
6.5 CVE-2026-82054 A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially crafted $jsonSchema filter field, the parse…
8.1 CVE-2026-18712 An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruct…
7.1 CVE-2026-18711 An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to cause an internal reference to be used after the underlying memory has been f…
6.5 CVE-2026-18705 An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve documents from a different, protected view over the same underlyi…
4.3 CVE-2026-18707 An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to terminate unexpectedly by submitting a specially formed aggre…
6.4 CVE-2026-18708 An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control to be executed within the query scope of other users, thr…
6.4 CVE-2026-18709 An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transact…
5.4 CVE-2026-18698 An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that should require more specific privileg…
6.5 CVE-2026-18699 An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to terminate unexpectedly by submitting a specially formed query…
6.5 CVE-2026-18700 An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed, thro…
6.5 CVE-2026-18701 An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server process to terminate unexpectedly by submitting a specially formed query filt…
6.4 CVE-2026-18702 An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings that affect the entire server rather than just the intend…
4.2 CVE-2026-18703 An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certificate-based authentication method, even when an adminis…
8.8 CVE-2026-18692 An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory ha…
7.6 CVE-2026-18693 An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal data structure to become inconsistent through certain do…
7.1 CVE-2026-18694 An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileges to cause certain malformed geometry data to be stored and later processed without pr…
6.5 CVE-2026-18695 An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaField could allow an authenticated user with write access to cause the server process to…
6.5 CVE-2026-18696 An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default privileges to perform certain data-definition operations, such as dropping or modifying col…
7.5 CVE-2026-18697 An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) process to terminate unexpectedly by submitting a specially formed aggregation com…
7.1 CVE-2026-18687 MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain request parameters against the collection's encrypted field configuration before use. An…
7.1 CVE-2026-18688 An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-bounds memory read by providing a specially formed numeric parameter in a certain aggregati…
8.1 CVE-2026-18690 An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that their assigned privileges should not…
8.8 CVE-2026-18691 An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used when one replica set member connects…
6.5 CVE-2026-9737 During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case. This may lead to incorrect transformations leading to in…
5.3 CVE-2026-13074 An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's…
6.5 CVE-2026-13075 An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The issue originates in th…
7.1 CVE-2026-13077 A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an…
7.7 CVE-2026-13078 A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files…
4.2 CVE-2026-13068 An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for…
6.5 CVE-2026-13069 An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used…
5.3 CVE-2026-13070 A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCSP stapling validation is en…
6.5 CVE-2026-13071 An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory…
8.1 CVE-2026-13072 When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potenti…
6.5 CVE-2026-13062 An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by send…
4.3 CVE-2026-13063 An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted aggregation command. MongoDB's libmongocry…
6.5 CVE-2026-13064 Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading to resource exhaustion. The…
6.5 CVE-2026-13065 A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to termin…
6.5 CVE-2026-13066 Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the cli…
6.5 CVE-2026-13055 The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle compound wildcard index specifications, trig…
5.3 CVE-2026-13057 An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user access controls. In sharded topologies, the $search and $searchMeta aggregation stages use inter…
6.5 CVE-2026-13058 An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomplete set of required fields. The issue…
8.1 CVE-2026-13059 An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain…
6.5 CVE-2026-13060 An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stag…

Breaking changes

None in the release notes.

Security changes

security CVE-2026-82059 in 8.3.9
security CVE-2026-82058 in 8.3.9
security CVE-2026-82057 in 8.3.9
security CVE-2026-82056 in 8.3.9
security CVE-2026-82055 in 8.3.9
security CVE-2026-82054 in 8.3.9
security CVE-2026-82053 in 8.3.9
security CVE-2026-82076 in 8.3.9
security CVE-2026-82075 in 8.3.9
security CVE-2026-82073 in 8.3.9
security CVE-2026-82071 in 8.3.9
security CVE-2026-82070 in 8.3.9
security CVE-2026-82069 in 8.3.9
security CVE-2026-82068 in 8.3.9
security CVE-2026-82067 in 8.3.9
security CVE-2026-82066 in 8.3.9
security CVE-2026-82065 in 8.3.9
security CVE-2026-82064 in 8.3.9
security CVE-2026-82063 in 8.3.9
security CVE-2026-82062 in 8.3.9
security CVE-2026-82061 in 8.3.9
security CVE-2026-82060 in 8.3.9
security CVE-2026-82052 in 8.3.9
security SERVER-128253 Integer overflow in query planner explodeForSort() can trigger mongod denial of service in 8.3.9
security Fixes CVE-2026-82070: A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected credentials from concurrent administra… in 8.3.8
security CVE-2026-18687 in 8.3.8
security CVE-2026-18688 in 8.3.8
security CVE-2026-18690 in 8.3.8
security CVE-2026-18691 in 8.3.8
security CVE-2026-18692 in 8.3.8
security CVE-2026-18693 in 8.3.8
security CVE-2026-18694 in 8.3.8
security CVE-2026-18695 in 8.3.8
security CVE-2026-18696 in 8.3.8
security CVE-2026-18697 in 8.3.8
security CVE-2026-18698 in 8.3.8
security CVE-2026-18699 in 8.3.8
security CVE-2026-18700 in 8.3.8
security CVE-2026-18701 in 8.3.8
security CVE-2026-18702 in 8.3.8
security CVE-2026-18703 in 8.3.8
security CVE-2026-18704 in 8.3.8
security CVE-2026-18705 in 8.3.8
security CVE-2026-18706 in 8.3.8
security CVE-2026-18707 in 8.3.8
security CVE-2026-18708 in 8.3.8
security CVE-2026-18709 in 8.3.8
security CVE-2026-18711 in 8.3.8
security CVE-2026-18712 in 8.3.8
security CVE-2026-9737 in 8.3.7
security CVE-2026-13055 in 8.3.7
security CVE-2026-13056 in 8.3.7
security CVE-2026-13057 in 8.3.7
security CVE-2026-13058 in 8.3.7
security CVE-2026-13059 in 8.3.7
security CVE-2026-13060 in 8.3.7
security CVE-2026-13061 in 8.3.7
security CVE-2026-13062 in 8.3.7
security CVE-2026-13063 in 8.3.7
security CVE-2026-13064 in 8.3.7
security CVE-2026-13065 in 8.3.7
security CVE-2026-13066 in 8.3.7
security CVE-2026-13067 in 8.3.7
security CVE-2026-13068 in 8.3.7
security CVE-2026-13069 in 8.3.7
security CVE-2026-13070 in 8.3.7
security CVE-2026-13071 in 8.3.7
security CVE-2026-13072 in 8.3.7
security CVE-2026-13074 in 8.3.7
security CVE-2026-13075 in 8.3.7
security CVE-2026-13076 in 8.3.7
security CVE-2026-13077 in 8.3.7
security CVE-2026-13078 in 8.3.7
security MongoDB 8.3.4 contains a fix for CVE-2026-11933 in 8.3.4
security Fixes CVE-2026-9754: An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command in 8.3.3
security CVE-2026-9735 in 8.3.3
security CVE-2026-9740 in 8.3.3
security CVE-2026-9741 in 8.3.3
security CVE-2026-9742 in 8.3.3
security CVE-2026-9746 in 8.3.3
security CVE-2026-9747 in 8.3.3
security CVE-2026-9748 in 8.3.3
security CVE-2026-9749 in 8.3.3
security CVE-2026-9750 in 8.3.3
security CVE-2026-9751 in 8.3.3
security CVE-2026-9752 in 8.3.3
security CVE-2026-9753 in 8.3.3
security Fixes CVE-2026-8336: After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subsequently crash mongod when the… in 8.3.2
security Fixes CVE-2026-8199: An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear. This contributes to memory pressure an… in 8.3.2
security Fixes CVE-2026-8201: A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared. Triggering this vulnerability r… in 8.3.2
security Fixes CVE-2026-8202: Using a densely populated chars mask and a large input string in the MongoDB aggregation operators $trim, $ltrim, and $rtrim, an authenticated user with aggregation permissions can pin CPU utilizat… in 8.3.2
security Fixes CVE-2026-8200: When schema validation is enabled on a collection and an update or insert would violate the collection's schema, the local server log message generated may not have all user data redacted. This… in 8.3.2
security MongoDB 8.3.2 contains a fix for CVE-2026-8053 in 8.3.2
security CVE-2026-8199 in 8.3.1
security CVE-2026-8200 in 8.3.1
security CVE-2026-8201 in 8.3.1
security CVE-2026-8202 in 8.3.1
security CVE-2026-8336 in 8.3.1
security MongoDB 8.3 includes fixes for CVE-2025-12893, CVE-2025-13507, CVE-2025-14345, and CVE-2026-8336, CVE-2026-9754. in 8.3.0
security For the latest information about MongoDB security updates, see MongoDB Security Bulletins. in 8.3.0
security Fixes CVE-2026-13072: When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potenti… in 8.2.12
security Fixes CVE-2026-13059: An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain… in 8.2.12
security Fixes CVE-2026-13078: A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files… in 8.2.12
security Fixes CVE-2026-13077: A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an… in 8.2.12
security Fixes CVE-2026-13075: An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The issue originates in th… in 8.2.12
security Fixes CVE-2026-13069: An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used… in 8.2.12
security Fixes CVE-2026-13071: An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory… in 8.2.12
security Fixes CVE-2026-13062: An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by send… in 8.2.12
security Fixes CVE-2026-13064: Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading to resource exhaustion. The… in 8.2.12
security Fixes CVE-2026-13065: A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to termin… in 8.2.12
security Fixes CVE-2026-13066: Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the cli… in 8.2.12
security Fixes CVE-2026-13055: The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle compound wildcard index specifications, trig… in 8.2.12
security Fixes CVE-2026-13058: An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomplete set of required fields. The issue… in 8.2.12
security Fixes CVE-2026-13060: An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stag… in 8.2.12
security Fixes CVE-2026-13074: An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's… in 8.2.12
security Fixes CVE-2026-13070: A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCSP stapling validation is en… in 8.2.12
security Fixes CVE-2026-13057: An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user access controls. In sharded topologies, the $search and $searchMeta aggregation stages use inter… in 8.2.12
security Fixes CVE-2026-13063: An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted aggregation command. MongoDB's libmongocry… in 8.2.12
security Fixes CVE-2026-13068: An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for… in 8.2.12

Every release in between

8.3.9 Sep 8, 2026 Release notes ↗

securityCVE-2026-82059

securityCVE-2026-82058

securityCVE-2026-82057

securityCVE-2026-82056

securityCVE-2026-82055

securityCVE-2026-82054

securityCVE-2026-82053

securityCVE-2026-82076

securityCVE-2026-82075

securityCVE-2026-82073

securityCVE-2026-82071

securityCVE-2026-82070

securityCVE-2026-82069

securityCVE-2026-82068

securityCVE-2026-82067

securityCVE-2026-82066

securityCVE-2026-82065

securityCVE-2026-82064

securityCVE-2026-82063

securityCVE-2026-82062

securityCVE-2026-82061

securityCVE-2026-82060

securityCVE-2026-82052

otherSERVER-87919 Stop taking unstable checkpoints during recovery for restore

fixSERVER-96874 Replication recovery can crash due to concurrent shutdown

otherSERVER-125742 Remove the graceful exit for kernel version 7.0.14 and above

otherSERVER-132246 minWaitForStreamingHelloMillis default breaks spec-compliant drivers

otherSERVER-130571 Limit use of $_internalIndexKey to internal clients only

otherSERVER-130926 Usage of strtoll in generateJSONSchemaArraySingleSchemaError can throw std::exception

featureSERVER-130495 WiredTigerRecordStore configString allows overriding WiredTiger value_format

otherSERVER-130306 Fix heap-use-after-free in TextMatchExpression

otherSERVER-130202 Clean up stale state in GeometryContainer when GeoJSON parsing fails

otherSERVER-130901 Limit JSON Pointer path depth to 255 for $jsonSchema.encryptMetadata.keyId

otherSERVER-130785 Fix LDAP roles for pooled LDAP connections

securitySERVER-128253 Integer overflow in query planner explodeForSort() can trigger mongod denial of service

otherSERVER-132650 Make mongos use the configurable minimum timeout for pre-auth streamable hello

otherSERVER-132125 Ban $_isHybridSearch at top-level agg command requests

otherSERVER-131860 Improve wiredtiger config string handling

otherSERVER-131423 Apply consistent redaction in reportState()

fixSERVER-131326 Repeat stmtIds on writes crash the server

+12 more items in the release notes

8.3.8 Aug 11, 2026 Release notes ↗

securityFixes CVE-2026-82070: A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected credentials from concurrent administra…

securityCVE-2026-18687

securityCVE-2026-18688

securityCVE-2026-18690

securityCVE-2026-18691

securityCVE-2026-18692

securityCVE-2026-18693

securityCVE-2026-18694

securityCVE-2026-18695

securityCVE-2026-18696

securityCVE-2026-18697

securityCVE-2026-18698

securityCVE-2026-18699

securityCVE-2026-18700

securityCVE-2026-18701

securityCVE-2026-18702

securityCVE-2026-18703

securityCVE-2026-18704

securityCVE-2026-18705

securityCVE-2026-18706

securityCVE-2026-18707

securityCVE-2026-18708

securityCVE-2026-18709

securityCVE-2026-18711

securityCVE-2026-18712

otherSERVER-123864 Improve $lookup local-read fallback in sharded_agg_helpers

otherSERVER-127863 Enforce authenticationMechanisms on the SASL MONGODB-X509 path

otherSERVER-128392 Duplicate insert into a clustered collection whose _id contains a Decimal128 throws a KeyString format error

otherSERVER-128482 Disallow $documents with $_resumeAfter or $_startAt

otherSERVER-128551 Fix initialization order of $unwind in $graphLookup

otherSERVER-129460 Ensure valid jsonSchema in time series updates

otherSERVER-129617 Better validation for NaN in $percentile and $median

otherSERVER-129618 Disallow user-provided $vectorSearch arguments from overriding internally generated options

fixSERVER-129887 Fix a collision in bucket OIDs during bucket allocation that leaves a dangling pointer to the bucket

otherSERVER-129936 Tighten validation of $idLookup internal fields

fixSERVER-129994 Fix a malformed FlatBSON store caused by inserting duplicate field names

otherSERVER-130110 Gate the internal-only _internalSetObjToThis field of $function behind an internal-client check

otherSERVER-130111 Prevent invalid type conversion during match expression serialization

fixSERVER-130117 Fix a heap use-after-free in collection validation for big polygons

otherSERVER-130139 Account for the o-versus-UUID consistency check

+12 more items in the release notes

8.3.7 Jul 24, 2026 Release notes ↗

securityCVE-2026-9737

securityCVE-2026-13055

securityCVE-2026-13056

securityCVE-2026-13057

securityCVE-2026-13058

securityCVE-2026-13059

securityCVE-2026-13060

securityCVE-2026-13061

securityCVE-2026-13062

securityCVE-2026-13063

securityCVE-2026-13064

securityCVE-2026-13065

securityCVE-2026-13066

securityCVE-2026-13067

securityCVE-2026-13068

securityCVE-2026-13069

securityCVE-2026-13070

securityCVE-2026-13071

securityCVE-2026-13072

securityCVE-2026-13074

securityCVE-2026-13075

securityCVE-2026-13076

securityCVE-2026-13077

securityCVE-2026-13078

otherSERVER-123081 Handle compound wildcard index spec in $_internalIndexKey

otherSERVER-124355 Improve memory checks for array expressions to prevent huge in-memory arrays from $concatArrays combined with $range

otherSERVER-125872 Fix exponential hashing of query solutions for InternalSchema*MatchExpression nodes

otherSERVER-126247 Properly validate $search.mergingPipeline as an internal-only field

otherSERVER-127280 Reject expression-based sortBy in the $linearFill parser

otherSERVER-127357 Check for duplicate from fields in DocumentSourceGraphLookup::createFromBson()

otherSERVER-127566 Limit the contention factor that can be used for FLE2 fields

otherSERVER-127661 Require autocommit when startOrContinueTransaction is specified

featureSERVER-127689 Only allow internal clients to specify $_internalPredicate

featureSERVER-127694 Add type checking for DBPointer

otherSERVER-127737 Limit the number of metadata blocks allowed in a FLE2IndexedTextEncryptedValue

fixSERVER-128341 Fix a server crash caused by sorting on a $meta expression

featureSERVER-128362 Add a null check on the return value in ocspClientCallback

fixSERVER-128473 Fix a use-after-free in $function caused by a missing advanceGeneration() call on retained BSON arguments

featureSERVER-128517 Add a configurable minimum timeout for pre-auth streamable hello to prevent a hot loop from very small maxAwaitTimeMS values

featureSERVER-128584 Add memory checks for $convert from BinData to an array

+14 more items in the release notes

8.3.4 Jun 15, 2026 Release notes ↗

securityMongoDB 8.3.4 contains a fix for CVE-2026-11933

otherSERVER-128125 Align bsonObjToArray ownership semantics with bsonGetImmutable

otherAll JIRA issues closed in 8.3.4

other8.3.4 Changelog

8.3.3 Jun 15, 2026 Release notes ↗

securityFixes CVE-2026-9754: An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command

securityCVE-2026-9735

securityCVE-2026-9740

securityCVE-2026-9741

securityCVE-2026-9742

securityCVE-2026-9746

securityCVE-2026-9747

securityCVE-2026-9748

securityCVE-2026-9749

securityCVE-2026-9750

securityCVE-2026-9751

securityCVE-2026-9752

securityCVE-2026-9753

otherSERVER-118434 Makes the CBR eligible for use during query planning

featureSERVER-115402 Adds explain output to the CBR

featureSERVER-120369 Adds serverStatus metrics for the CBR

featureSERVER-117199 Adds $queryStats metrics for the CBR

fixSERVER-115250 Pause JWKSetRefreshJob during quiesce time

fixSERVER-121822 Clustered collections do not correctly filter out results with $lt on _id

fixSERVER-125887 Add support for encrypted PEM fules for gRPC egress

fixSERVER-126049 MozJS per-scope heap limit check uses process-global GC counter

fixWT-16780 Insufficient error context in WT_PANIC checkpoint failures in __wt_block_checkpoint_resolve

fixSERVER-126506 Remove SASL params from egress logging

fixSERVER-125063 Prohibit nesting of BSONColumn inside BSONColumn

fixSERVER-123507 Encrypted predicates inside a $vectorSearch prefilter should get replaced with encryption placeholders

fixSERVER-124183 Limit scope of authenticate

fixSERVER-124190 Forbid aggregate exchange field from non-internal clients

fixSERVER-123918 Validate runtimeConstants.userRoles in IDL

fixSERVER-123951 $_internalConvertBucketIndexStats should not return PauseExecution on failed index conversion

fixSERVER-124031 Ensure Exchange::getTargetConsumer correctly handles MaxKey

fixSERVER-123633 Fix handling of user $-prefixed fields colliding with internal metadata

fixSERVER-123370 LDAP query password is logged when set through setParameter

fixSERVER-123440 GeometryCollection with strict-winding polygon causes 2dsphere index key generation crash

fixSERVER-124959 Validate doc diff array bounds and $_internalApplyOplogUpdate BSON

fixAll JIRA issues closed in 8.3.3

fix8.3.3 Changelog

8.3.2 May 14, 2026 Release notes ↗

securityFixes CVE-2026-8336: After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subsequently crash mongod when the…

securityFixes CVE-2026-8199: An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear. This contributes to memory pressure an…

securityFixes CVE-2026-8201: A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared. Triggering this vulnerability r…

securityFixes CVE-2026-8202: Using a densely populated chars mask and a large input string in the MongoDB aggregation operators $trim, $ltrim, and $rtrim, an authenticated user with aggregation permissions can pin CPU utilizat…

securityFixes CVE-2026-8200: When schema validation is enabled on a collection and an update or insert would violate the collection's schema, the local server log message generated may not have all user data redacted. This…

securityMongoDB 8.3.2 contains a fix for CVE-2026-8053

otherSERVER-126021 Undefined behavior when inserting data with duplicate field names into timeseries collections

otherAll JIRA issues closed in 8.3.2

other8.3.2 Changelog

8.3.1 Jun 3, 2026 Release notes ↗

securityCVE-2026-8199

securityCVE-2026-8200

securityCVE-2026-8201

securityCVE-2026-8202

securityCVE-2026-8336

otherSERVER-121610 Ensure cached emit() calls are no-op

otherSERVER-121895 Improve redaction of validation errors

otherSERVER-124974 Ensure memory lifetime during $match pushdown analysis

otherAll JIRA issues closed in 8.3.1

other8.3.1 Changelog

8.3.0 Jun 3, 2026 Release notes ↗

otherImportant

securityMongoDB 8.3 includes fixes for CVE-2025-12893, CVE-2025-13507, CVE-2025-14345, and CVE-2026-8336, CVE-2026-9754.

securityFor the latest information about MongoDB security updates, see MongoDB Security Bulletins.

8.2.12 Jul 28, 2026 Release notes ↗

securityFixes CVE-2026-13072: When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potenti…

securityFixes CVE-2026-13059: An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain…

securityFixes CVE-2026-13078: A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files…

securityFixes CVE-2026-13077: A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an…

securityFixes CVE-2026-13075: An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The issue originates in th…

securityFixes CVE-2026-13069: An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used…

securityFixes CVE-2026-13071: An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory…

securityFixes CVE-2026-13062: An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by send…

securityFixes CVE-2026-13064: Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading to resource exhaustion. The…

securityFixes CVE-2026-13065: A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to termin…

securityFixes CVE-2026-13066: Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the cli…

securityFixes CVE-2026-13055: The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle compound wildcard index specifications, trig…

securityFixes CVE-2026-13058: An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomplete set of required fields. The issue…

securityFixes CVE-2026-13060: An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stag…

securityFixes CVE-2026-13074: An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's…

securityFixes CVE-2026-13070: A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCSP stapling validation is en…

securityFixes CVE-2026-13057: An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user access controls. In sharded topologies, the $search and $searchMeta aggregation stages use inter…

securityFixes CVE-2026-13063: An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted aggregation command. MongoDB's libmongocry…

securityFixes CVE-2026-13068: An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for…