CVE-2026-114653 Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builder

A client-side encryption schema construction component in the MongoDB C Driver places caller-supplied field identifiers into a position that is interpreted as a pattern expression, without normalizing or validating them. As a result, an application that designates certain fields for client-side...