MongoDB CVE-2026-118383 (CVSS 9.5): two unauthenticated requests can crash a replica set member when it later becomes primary; patch every member

official (MongoDB security announcement, Nov 10, 2026; CVE record/GHSA); MongoDB says it is not aware of exploitation attempts; Datadog reproduced the crash, not code execution2026-11-12 7:40 AM ET

MongoDB CVE-2026-118383 (CVSS 9.5): two unauthenticated requests can crash a replica set member when it later becomes primary; patch every member

How it works (Datadog Security Labs, via The Hacker News): two ping commands carrying readConcern.afterOpTime plant waiters that never expire; if that member later wins an election while lagging, catch-up cleanup runs twice and the new primary segfaults before accepting writes. Turning on authentication doesn't block the two requests on vulnerable versions. The attacker can't force the lag or the election.
Fix detail: in 8.0.37 only system users can use readConcern.afterOpTime.
Do now: upgrade every replica set member, including containers and members that were offline; Atlas users who defer maintenance should apply it now; restrict network access to the database meanwhile.
8.3.16 also fixes about 20 other MongoDB CVEs (CVE-2026-120803 to -120828).

Sources: MongoDB Community Hub: Important MongoDB security update available (Action Required), Nov 10, 2026 · GitHub Advisory GHSA-fjxh-6vgh-cx2c (CVE-2026-118383) · The Hacker News: Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on Failover (summarizes Datadog Security Labs' analysis)