MongoDB has, once again, published fixes for end-of-life software. Should we re-add them for CVE-2026-11933?
A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated user with read privileges who is able to run server-side JavaScript (for example, via $where or $function) can cause the server to access memory that has already been freed. This may result in disclosure of information from the mongod process memory or a denial of service through a server crash.
4.4.31, 5.0.34, and 6.0.29 have all been released that address this bug.
(Currently active versions are already updated: b05f3db, 962851f, a8cac75, 2c69a57)
MongoDB has, once again, published fixes for end-of-life software. Should we re-add them for CVE-2026-11933?
4.4.31, 5.0.34, and 6.0.29 have all been released that address this bug.
(Currently active versions are already updated: b05f3db, 962851f, a8cac75, 2c69a57)