Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-119179— MongoDB Node.js driver: Connection pool desynchronization after operation timeout can expose other user's data

Quick assessment

Affected
MongoDB Node.js Driver
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MongoDB Node.js 驱动的连接管理层存在一个缺陷：当某个池化网络连接上仍有先前操作的数据尚未处理完毕时，该连接仍可能被放回连接池以供复用。在启用了可选的客户端操作超时功能的应用中，任何能够向该应用发送普通请求的未认证攻击者，都可能导致数据库返回的响应与错误的请求错误配对。这可能造成其他用户记录的意外泄露、返回错误的操作结果，以及合法请求执行失败。

CVSS 7.0 · High

Affected Version Matrix 2

VendorProduct Version RangeStatus
MongoDB Node.js Driver 6.11.0< 6.22.0 affected
7.0.0< 7.8.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-119179

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MongoDB Node.js driver: Connection pool desynchronization after operation timeout can expose other user's data
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw in the connection management layer of the MongoDB Node.js driver can leave a pooled network connection in the pool for reuse while data from an earlier operation is still outstanding on it. In applications that enable an optional client-side operation timeout, an unauthenticated party that can send ordinary requests to the application may cause database replies to be paired with the wrong requests. This may result in unintended disclosure of other users' records, incorrect operation results being returned, and failures of legitimate requests.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
在释放前未清除敏感信息
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
MongoDB Node.js Driver 6.11.0 ~ 6.22.0 -

II. Public POCs for CVE-2026-119179

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-119179

请登录查看更多情报信息。

Other References for CVE-2026-119179 (1)

Same Patch Batch · MongoDB · 2026-11-03 · 15 CVEs total

CVE-2026-119675 8.6 HIGH mongorestore may bypass collection guards through a system.buckets prefix
CVE-2026-120678 7.5 HIGH MongoDB C Driver leaks the decompressed reply buffer when an OP_COMPRESSED reply fails to
CVE-2026-120955 7.5 HIGH MongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Applicatio
CVE-2026-120956 7.1 HIGH remote abort and memory disclosure from a malformed cursor.ns
CVE-2026-120952 7.1 HIGH MongoDB Atlas SQL ODBC Driver writes 48-byte Extended JSON into fixed 16-byte SQL_C_GUID t
CVE-2026-120684 6.5 MEDIUM MongoDB C Driver GridFS gap lets a shared writer recover a protected client's password
CVE-2026-120673 5.5 MEDIUM Rust Driver 3.9.1 exports CSFLE plaintext in `db.query.text` before encrypting the command
CVE-2026-120567 5.4 MEDIUM ExecuteUpdate may evaluate caller-supplied values as MongoDB expressions
CVE-2026-119672 4.8 MEDIUM mongofiles may disclose GridFS content to standard output through a stored filename
CVE-2026-120953 4.3 MEDIUM Atlas SQL JDBC Driver <=4.0.0: OIDC discovery endpoints not scheme-validated - attacker-co
CVE-2026-119674 3.7 LOW mongorestore may restore encoded collection names into an unintended collection
CVE-2026-120954 3.7 LOW Silent element-count truncation via 32-bit bit-length overflow in packed-bit vector views
CVE-2026-120959 3.7 LOW MongoDB Atlas SQL ODBC Driver uses ignored SQLBindCol BufferLength as fixed-width row-arra
CVE-2026-119673 2.8 LOW mongofiles may write outside the working directory through a symlink

IV. Related Vulnerabilities

Same vendor: MongoDB
Same weakness: CWE-226