Cpe:2.3:a:mongodb:node_js_driver:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3amongodbnode_js_driver/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 03 Nov 2026 16:00:48 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMongoDB Node.js Driver: Connection Management Data Disclosure (CVE-2026-119179)https://feed.craftedsignal.io/briefs/2026-11-mongodb-nodejs-driver-vulnerability/Tue, 03 Nov 2026 16:00:48 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-mongodb-nodejs-driver-vulnerability/A flaw in the connection management layer of the MongoDB Node.js driver allows for unintended data disclosure, incorrect operation results, and request failures when client-side operation timeouts are enabled.<p>A flaw in the connection management layer of the MongoDB Node.js driver can leave a pooled network connection in the pool for reuse while data from an earlier operation is still outstanding. In applications that enable an optional client-side operation timeout, an unauthenticated party can cause database replies to be paired with the wrong requests. This may result in the unintended disclosure of other users' records, incorrect operation results, or failures of legitimate requests.</p> highadvisory