CVE-2025-12893 Improper Certificate Validation May Allow Successful TLS Handshaking Despite Invalid Extended Key Usage Fields in MongoDB Server

Clients may successfully perform a TLS handshake with a MongoDB server despite presenting a client certificate not aligning with the documented Extended Key Usage EKU requirements. A certificate that specifies extendedKeyUsage but is missing extendedKeyUsage = clientAuth may still be successfully...

CVE-2025-13507 Time-series operations may cause internal BSON size limit to be exceed

Inconsistent object size validation in time series processing logic may result in later processing of oversized BSON documents leading to an assert failing and process termination. This issue impacts MongoDB Server v7.0 versions prior to 7.0.26, v8.0 versions prior to 8.0.16 and MongoDB server v8...

CVE-2025-13507

The CVE-2025-13507 entry describes an issue in MongoDB Server: inconsistent object size validation in the time series processing path can cause oversized BSON documents to be processed later, triggering an assertion and process termination. Affected versions are MongoDB Server v7.0 before 7.0.26,...

CVE-2025-13507 Time-series operations may cause internal BSON size limit to be exceed

Inconsistent object size validation in time series processing logic may result in later processing of oversized BSON documents leading to an assert failing and process termination. This issue impacts MongoDB Server v7.0 versions prior to 7.0.26, v8.0 versions prior to 8.0.16 and MongoDB server v8...

Malicious code in @voiceflow/nestjs-mongodb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2004e6b1248a0973eb52ceacef7b58dbf4de7c31813ea2b67f07e2788ad3205e The package @voiceflow/nestjs-mongodb was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-199404

Malicious code in @voiceflow/nestjs-mongodb npm...

MAL-2025-191358 Malicious code in @voiceflow/nestjs-mongodb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2004e6b1248a0973eb52ceacef7b58dbf4de7c31813ea2b67f07e2788ad3205e The package @voiceflow/nestjs-mongodb was found to contain malicious code. Source: ghsa-malware...

MongoDB -- Improper Validation of Specified Quantity in Input

https://jira.mongodb.org/browse/SERVER-108565 reports: Inconsistent object size validation in time series processing logic may result in later processing of oversized BSON documents leading to an assert failing and process termination...

MongoDB Server 安全漏洞

MongoDB Server is a set of open source NoSQL databases from the American company MongoDB. The database provides collection-oriented storage, dynamic querying, data replication and automatic failover. A security vulnerability exists in MongoDB Server versions 7.0 through 7.0.26 prior, 8.0 through...

MongoDB Server 安全漏洞

MongoDB Server is a set of open source NoSQL databases from the American company MongoDB. The database provides collection-oriented storage, dynamic querying, data replication and automatic failover. A security vulnerability exists in MongoDB Server version v7.0 up to and including version 7.0.26...

MongoDB Server 安全漏洞

MongoDB Server is a set of open source NoSQL databases from the American company MongoDB. The database provides collection-oriented storage, dynamic querying, data replication and automatic failover. A security vulnerability exists in MongoDB Server version v7.0 up to and including version 7.0.26...

MongoDB Server 安全漏洞

MongoDB Server is a set of open source NoSQL databases from the American company MongoDB. The database provides collection-oriented storage, dynamic querying, data replication and automatic failover. A security vulnerability exists in MongoDB Server versions v7.0 through 7.0.26 prior, v8.0 throug...

MongoDB Server -- Improper Certificate Validation

https://jira.mongodb.org/browse/SERVER-105783 reports: Clients may successfully perform a TLS handshake with a MongoDB server despite presenting a client certificate not aligning with the documented Extended Key Usage EKU requirements. A certificate that specifies extendedKeyUsage but is missing...

PT-2025-47990

Name of the Vulnerable Software and Affected Versions MongoDB Server versions prior to 7.0.26 MongoDB Server versions prior to 8.0.14 Description A user with limited privileges within a cluster may be able to terminate queries initiated by other users. This could lead to a denial of service by...

PT-2025-47989

Name of the Vulnerable Software and Affected Versions MongoDB Server versions prior to 7.0.26 MongoDB Server versions prior to 8.0.16 MongoDB Server versions prior to 8.2.1 Description An issue exists in the time series processing logic where inconsistent object size validation can lead to the...

MongoDB -- Missing Authorization

https://jira.mongodb.org/browse/SERVER-103582 reports: A user with access to the cluster with a limited set of privilege actions may be able to terminate queries that are being executed by other users. This may cause a denial of service by preventing a fraction of queries from successfully...

MongoDB driver extension affected by mongoc_bulk_operation_t's read of invalid memory

A mongocbulkoperationt may read invalid memory if large options are passed...

GHSA-MWCC-7VPP-XMV9 MongoDB driver extension affected by mongoc_bulk_operation_t's read of invalid memory

A mongocbulkoperationt may read invalid memory if large options are passed...

Expired Pointer Dereference

Overview mongodb/mongodb-extension is a MongoDB driver extension Affected versions of this package are vulnerable to Expired Pointer Dereference via mongocbulkoperationt when large options are passed. An attacker can cause the application to read invalid memory. Remediation Upgrade...

Expired Pointer Dereference

Overview Affected versions of this package are vulnerable to Expired Pointer Dereference via mongocbulkoperationt when large options are passed. An attacker can cause the application to read invalid memory. Remediation Upgrade mongo-c-driver to version 1.30.6 or higher. References - GitHub Commit...