CVE-2026-11933

Name of the Vulnerable Software and Affected Versions MongoDB Server (affected versions not specified)

Description A use-after-free memory corruption flaw exists in the server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated user with read privileges who can execute server-side JavaScript, such as through the $where or $function operators, can cause the server to access memory that has already been freed. This can lead to a denial of service via a server crash or the disclosure of information from the mongod process memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict server-side JavaScript execution to minimize the risk of exploitation.