A critical flaw in MongoDB Server allows an unauthenticated attacker to send two requests that trigger a crash on the database server. The crash occurs only if that server is later chosen to take over as the main server while it still lacks some recent changes.

MongoDB, the company that makes the database, released fixed versions earlier this week.

The affected servers are members of a replica set, a group of MongoDB servers that keep copies of the same data. One member, the primary, serves as the main server and handles all new writes, while the others replicate them. If the primary becomes unavailable, the other members hold an election to pick a new primary.

Researchers at Datadog Security Labs reproduced the crash in a lab and published their findings yesterday. On vulnerable versions, turning on authentication does not stop the two requests. An attacker cannot make the targeted member fall behind or win an election, or see when either happens, the researchers said.

The flaw, tracked as CVE-2026-118383, is a use-after-free: the server ends up using memory it has already freed. MongoDB rated it 9.5 out of 10 on the CVSS 4.0 severity scale. The company said it found the flaw itself and was "not aware of any attempts to take advantage of this vulnerability."

Affected members include the shard and config server members of sharded clusters. A standalone mongod, a single server outside any replica set, is not affected.

Each affected branch has a fixed release, listed below and in the CVE record .

Source link