Security · High impactFan score 66 · Tier A3 sources
Serious security flaw in MongoDB: How your database could collapse
The Brief · written from 3 sources
- CVE-2026-118383 is a critical pre-auth flaw in MongoDB Server, rated 9.5 CVSS by DEV Community.
- An unauthenticated attacker can send two requests that trigger a use-after-free during replica set catch-up cleanup.
- The crash happens only if the affected server is later chosen as primary while still missing recent changes; MongoDB has released patches and no active exploitation is noted.
Why it matters
Unauthenticated attackers can crash MongoDB servers, and a lagging replica set member that is promoted to primary during failover may go down, which can disrupt database availability. Teams running MongoDB replica sets should patch.
Who’s affected
- Operators of MongoDB Server replica sets
What to do
- Apply the MongoDB Server patches released for CVE-2026-118383.
- CVE-2026-118383
- #mongodb
- #security
- #vulnerability
- #replica-set
- #database
- #cve
A critical flaw in MongoDB Server (CVE-2026-118383), rated 9.5 CVSS, allows unauthenticated attackers to trigger server crashes via a use-after-free during replica set catch-up cleanup. MongoDB released patches and notes no active exploitation. How is collapse caused? The issue…
Timeline
Datadog Security Labs
CVE-2026-118383: Use-after-free vulnerability in MongoDB
Flaw publicly reported and MongoDB released patches
The Hacker News
Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on Failover
DEV Community: backend
Serious security flaw in MongoDB: How your database could collapse
Full coverage · 3 sources
- 1h ago ↗
DEV Community: backend
Serious security flaw in MongoDB: How your database could collapse
- 2h ago ↗
The Hacker News
Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on Failover - 2d ago ↗
Datadog Security Labs
CVE-2026-118383: Use-after-free vulnerability in MongoDB