CVE-2026-8336

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-8336
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-8336.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-8336
Aliases
Downstream
Published
2026-05-13T00:16:16.568Z
Modified
2026-07-08T08:13:52.767217748Z
Severity
  • 7.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:N/R:A/V:D/RE:M/U:Red CVSS Calculator
Summary
Post-authentication use-after-free error in $_internalJsEmit and mapreduce commands
Details

After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subsequently crash mongod when the server-side JavaScript engine (through $where, $function, mapreduce reduce stage, etc.) is used also in a specific way, resulting in a post-authentication denial-of-service.

This issue impacts MongoDB Server v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "8.2"
                },
                {
                    "fixed": "8.2.9"
                },
                {
                    "introduced": "8.3"
                },
                {
                    "fixed": "8.3.2"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8336.json",
    "cna_assigner": "mongodb",
    "cwe_ids": [
        "CWE-416"
    ]
}
References

Affected packages

Git / github.com/mongodb/mongo

Affected ranges

Type
GIT
Repo
https://github.com/mongodb/mongo
Events
Introduced
b993867dce63dd366cd93e60f3f425ed716f6497
Fixed
551096db8ad4a951af553de51c5485d5fd91d40d
Introduced
0f29b043a58fdd251ce0a0b32754b8459613c933
Fixed
c531abff36f228c5ff24735ddf31a23536716ab0
Database specific 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "8.2.0"
        },
        {
            "fixed": "8.2.9"
        },
        {
            "introduced": "8.3.0"
        },
        {
            "fixed": "8.3.2"
        }
    ]
}

Affected versions

r8.*
r8.2.0
r8.2.1
r8.2.1-rc0
r8.2.1-rc1
r8.2.2
r8.2.2-rc0
r8.2.3-alpha0
r8.2.4-alpha0
r8.2.4-alpha1
r8.3.0
r8.3.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-8336.json"