CVE-2026-13066 — Server-Side JavaScript DBPointer BSON Serialization Memory Disclosure

CVE-2026-13066

Server-Side JavaScript DBPointer BSON Serialization Memory Disclosure PUBLISHED

Description (CNA)

Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments that use server-side JavaScript.

Affected (CNA)

Vendor / product	Versions
MongoDB / MongoDB Server	affected 7.0 before 7.0.39; affected 8.0 before 8.0.28; affected 8.2.0 before 8.2.12; affected 8.3.0 before 8.3.7

CWE

CWE-843

References

https://jira.mongodb.org/browse/SERVER-127694

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.