Vulnerability · Published Jul 22, 2026 · Assigned by mongodb
CVE-2026-13066Server-Side JavaScript DBPointer BSON Serialization Memory Disclosure
Medium 6.5
In plain English
A medium-severity type confusion in MongoDB Server from MongoDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.4%top 69.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments that use server-side JavaScript.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MongoDB | MongoDB Server | 7.0 – before 7.0.398.0 – before 8.0.288.2.0 – before 8.2.128.3.0 – before 8.3.7 |
Weakness: CWE-843 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N