MongoDB Node.js Driver vulnerabilities

Latest MongoDB Node.js Driver CVEs

Newest publication first

1. CVE-2026-119179 MongoDB Node.js driver: Connection pool desynchronization after operation timeout can expose other user's data

   Published 2026-11-03

   High·CVSS 8.3

   A flaw in the connection management layer of the MongoDB Node.js driver can leave a pooled network connection in the pool for reuse while data from an earlier operation is still outstanding on it. In applications that enable an optional client-side operation timeout, an unauthent...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.