MongoDB Node.js Driver: Erroneous Connection Pooling Enables Data Exposure
CVE-2026-119179 Published on November 3, 2026
MongoDB Node.js driver: Connection pool desynchronization after operation timeout can expose other user's data
A flaw in the connection management layer of the MongoDB Node.js driver can leave a pooled network connection in the pool for reuse while data from an earlier operation is still outstanding on it. In applications that enable an optional client-side operation timeout, an unauthenticated party that can send ordinary requests to the application may cause database replies to be paired with the wrong requests. This may result in unintended disclosure of other users' records, incorrect operation results being returned, and failures of legitimate requests.
Vulnerability Analysis
CVE-2026-119179 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
Sensitive Information in Resource Not Removed Before Reuse
When a device releases a resource such as memory or a file for reuse by other entities, information contained in the resource is not fully cleared prior to reuse of the resource.
Affected Versions
MongoDB Node.js Driver:- Version 6.11.0 and below 6.22.0 is affected.
- Version 7.0.0 and below 7.8.0 is affected.