MongoDB Node.js Driver: Connection Management Data Disclosure (CVE-2026-119179)
A flaw in the connection management layer of the MongoDB Node.js driver allows for unintended data disclosure, incorrect operation results, and request failures when client-side operation timeouts are enabled.
CVE search metadata
CVE search record: CVE-2026-119179. Severity: high. CVSS: 7.0. KEV: no. Product: MongoDB Node.js driver. Brief: MongoDB Node.js Driver: Connection Management Data Disclosure (CVE-2026-119179). Brief link: https://feed.craftedsignal.io/briefs/2026-11-mongodb-nodejs-driver-vulnerability/
Triage facts
Revision 2- Applicability
- MongoDB Node.js driver
- Evidence
- Unknown
- Severity
- High
- Sources
- 2 public sources
- Freshness
- Revision 2Nov 3, 16:15 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Revision history 1 entry · Revision 2
- Revision 2
poc_available
Changed: affected_products, affected_vendors, claim_state, cpes, has_poc, lastmod, poc_references, references, updates
Sources: 1
A flaw in the connection management layer of the MongoDB Node.js driver can leave a pooled network connection in the pool for reuse while data from an earlier operation is still outstanding. In applications that enable an optional client-side operation timeout, an unauthenticated party can cause database replies to be paired with the wrong requests. This may result in the unintended disclosure of other users' records, incorrect operation results, or failures of legitimate requests.