CVE-2026-13066

MediumCVSS 6.5/10Last modified Oct 24, 2026

Description

Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments that use server-side JavaScript.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-843

Affected software

No affected versions have been published.

Timeline

Published
Jul 22, 2026
Last modified
Oct 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-130676.3When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against theCVE-2026-130684.3An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a seCVE-2026-130696.5An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable EncCVE-2026-13076.5The Ninja Forms - The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Sensitive Information Exposure in all vCVE-2026-130705.3A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peerCVE-2026-130716.5An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute seCVE-2026-130728.1When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipCVE-2026-130734.3An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation commanCVE-2026-130745.3An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to CVE-2026-130756.5An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $sCVE-2026-130766.5An authenticated user can cause a {{mongod}} process to be terminated by the operating system under memory pressure by performing a specificCVE-2026-130777.1A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggre