Vulnerability · Published Nov 3, 2026 · Assigned by mongodb
CVE-2026-119179MongoDB Node.js driver: Connection pool desynchronization after operation timeout can expose other user's data
High 7.0
In plain English
A high-severity security flaw in Node.js Driver from MongoDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).
Official description
A flaw in the connection management layer of the MongoDB Node.js driver can leave a pooled network connection in the pool for reuse while data from an earlier operation is still outstanding on it. In applications that enable an optional client-side operation timeout, an unauthenticated party that can send ordinary requests to the application may cause database replies to be paired with the wrong requests. This may result in unintended disclosure of other users' records, incorrect operation results being returned, and failures of legitimate requests.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MongoDB | Node.js Driver | 6.11.0 – before 6.22.07.0.0 – before 7.8.0 |
Weakness: CWE-226 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L