Connection Management Vulnerability in MongoDB Node.js Driver

CVE-2026-119179

What is CVE-2026-119179?

A flaw in the connection management layer of the MongoDB Node.js driver allows pooled network connections to be reused while previous operations are still pending. This puts applications at risk, especially where optional client-side operation timeouts are enabled. An unauthenticated attacker capable of sending requests to the affected application may inadvertently receive database responses associated with other users’ requests. Consequently, this can lead to unintended data exposure, incorrect results being returned, and legitimate requests failing, compromising the integrity of the application.

References