MongoDB Node.js Driver: DNS SRV Host Discovery Validation Flaw (CVE-2026-126837)
A validation vulnerability in the DNS SRV host discovery of the MongoDB Node.js driver allows an unauthenticated party who can forge or modify DNS SRV responses to redirect database connections to arbitrary hosts.
CVE search metadata
CVE search record: CVE-2026-126837. Severity: high. CVSS: 7.4. KEV: no. Product: MongoDB Node.js Driver. Brief: MongoDB Node.js Driver: DNS SRV Host Discovery Validation Flaw (CVE-2026-126837). Brief link: https://feed.craftedsignal.io/briefs/2026-11-mongodb-dns-srv-redirection-cve-2026-126837/
Triage facts
Revision 1- Applicability
- MongoDB Node.js Driver
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 18:47 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The MongoDB Node.js driver is affected by a validation flaw in its DNS SRV host discovery process (CVE-2026-126837). When using mongodb+srv:// connection strings, the driver incorrectly validates host names returned in DNS SRV responses. Specifically, characters within the response can prematurely terminate a host name, allowing an actor who can forge or modify DNS SRV responses to redirect the driver to an arbitrary host. The driver verifies the server certificate against the redirected host name, meaning TLS does not prevent this redirection. Applications using mongodb:// connection strings are not affected.
Impact
Successful redirection of database connections may result in the unintended disclosure of application data and authentication credentials, as well as the alteration of query results.
Recommendation
Applications using mongodb+srv:// connection strings are at risk. It is advised to monitor environments for unusual DNS SRV responses or unexpected outbound connection attempts from Node.js applications.