Regex Vulnerability in MongoDB Server by MongoDB Inc.

CVE-2026-82052

What is CVE-2026-82052?

An authenticated user can exploit the $regexFindAll expression in MongoDB's aggregation pipeline to cause a server crash. This occurs when the regex match operation is initiated in the midst of a multi-code-unit character, which leads to an assertion failure during query execution. It is crucial for users to understand the risks and apply patches to prevent potential disruptions.

References