Validation Flaw in MongoDB Node.js Driver Allows Unauthorized Host Connections

CVE-2026-126837

What is CVE-2026-126837?

A validation flaw in the MongoDB Node.js driver allows an unauthenticated attacker to exploit DNS SRV responses, potentially connecting to unintended hosts and leading to unauthorized access to sensitive application data. When using a mongodb+srv:// connection string, the driver verifies the DNS SRV response against the expected domain, but the flaw allows an attacker to craft responses that cause the driver to connect to malicious hosts. This issue compromises data confidentiality and integrity, as TLS does not mitigate the risk, allowing attackers to manipulate connections and gain access to application credentials and data.

References