# Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on Failover

Source: [The Hacker News](https://thehackernews.com/2026/11/critical-pre-auth-mongodb-flaw-cve-2026.html) · 2026-11-12 · Security
Page: https://themorning.dev/story/critical-pre-auth-mongodb-flaw-cve-2026-118383-can-crash-lagging-servers-on-fail-26d811aac83d6968
Kind: security · Impact: high

## In brief

- CVE-2026-118383 is a critical pre-auth flaw in MongoDB Server, rated 9.5 CVSS by DEV Community.
- An unauthenticated attacker can send two requests that trigger a use-after-free during replica set catch-up cleanup.
- The crash happens only if the affected server is later chosen as primary while still missing recent changes; MongoDB has released patches and no active exploitation is noted.

## Why it matters

Unauthenticated attackers can crash MongoDB servers, and a lagging replica set member that is promoted to primary during failover may go down, which can disrupt database availability. Teams running MongoDB replica sets should patch.

## What to do

- Apply the MongoDB Server patches released for CVE-2026-118383.

## CVEs

- CVE-2026-118383

## Timeline

- 2026-11-12: Flaw publicly reported and MongoDB released patches

## Coverage

- [Serious security flaw in MongoDB: How your database could collapse](https://dev.to/hacksgr/serious-security-flaw-in-mongodb-how-your-database-could-collapse-17nm) — DEV Community: backend, 2026-11-12
- [Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on Failover](https://thehackernews.com/2026/11/critical-pre-auth-mongodb-flaw-cve-2026.html) — The Hacker News, 2026-11-12
- [CVE-2026-118383: Use-after-free vulnerability in MongoDB](https://securitylabs.datadoghq.com/articles/cve-2026-118383-mongodb-server-use-after-free/) — Datadog Security Labs, 2026-11-11

Tags: mongodb, security, vulnerability, replica-set, database, cve

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev