CVE-2026-89099: MongoDB Race Condition Vulnerability Leading to Memory Corruption
Summary
CVE-2026-89099: Race Condition in MongoDB Server Document Value Layer Leads to Memory Corruption. Affects mongodb across 4 version ranges.
>= 7.0.0, < 7.0.43
>= 8.0.0, < 8.0.32
>= 8.3.0, < 8.3.11
>= 9.0.0, < 9.0.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MongoDB is a widely-used open-source NoSQL database that provides high performance, high availability, and easy scalability. It stores data in flexible, JSON-like documents, allowing for dynamic schemas. However, the MongoDB server has a vulnerability that arises from a race condition in its document value layer, which can lead to memory corruption and potentially compromise the server's stability and security.
Vulnerability Detail
A race condition in the document value layer of MongoDB Server allows concurrent server threads to operate on the same internal memory without proper synchronization. This can lead to memory corruption, where an authenticated user with ordinary read-write privileges may exploit this condition through the normal client protocol. The consequences include server termination and potential corruption of process memory with user-influenced content, impacting the confidentiality, integrity, and availability of the affected server process.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.0.0, < 7.0.437.0.43 -
>= 8.0.0, < 8.0.328.0.32 -
>= 8.3.0, < 8.3.118.3.11 -
>= 9.0.0, < 9.0.29.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is strongly recommended to update to the patched versions as soon as possible to mitigate the risk.
Conclusion
In summary, CVE-2026-89099 is a critical vulnerability in MongoDB that can lead to memory corruption due to a race condition. Users are advised to update to the latest patched versions to safeguard their databases from potential exploitation.
See every vulnerability recorded for mongodb →
FAQ
CVE-2026-89099 is a vulnerability in MongoDB that arises from a race condition in its document value layer, leading to potential memory corruption.
Any authenticated user with ordinary read-write privileges on a MongoDB database may exploit this vulnerability.
The vulnerability can lead to server termination and memory corruption, affecting the confidentiality, integrity, and availability of the server process.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The best way to protect your MongoDB server is to update to one of the patched versions: 7.0.43, 8.0.32, 8.3.11, or 9.0.2.
References
Related vulnerabilities
Recent vulnerabilities recorded for mongodb.
