---
title: MongoDB CVE-2026-118383 (CVSS 9.5): two unauthenticated requests can crash a replica set member when it later becomes primary; patch every member | ctxsec
url: https://ctxsec.com/items/mongodb-cve-2026-118383-pre-auth-use-after-free-replica-set-catch-up-crash-9-5
description: "MongoDB fixed a use-after-free in replication that can be set up by requests that need no authentication: a newly elected primary crashes when it finishes catch-up, and MongoDB says code execution is possible under certain conditions. Replica set members are affected, including shard and config server members of sharded clusters; standalone mongod is not. Fixed in 9.0.7, 8.3.16, 8.0.37, 7.0.48, 6.0.30, 5.0.35 and 4.4.32. Atlas clusters get the fix during maintenance. MongoDB found the bug internally and says it isn't aware of attempts to exploit it."
status: "official (MongoDB security announcement, Nov 10, 2026; CVE record/GHSA); MongoDB says it is not aware of exploitation attempts; Datadog reproduced the crash, not code execution"
published: 2026-11-12
---

> MongoDB fixed a use-after-free in replication that can be set up by requests that need no authentication: a newly elected primary crashes when it finishes catch-up, and MongoDB says code execution is possible under certain conditions. Replica set members are affected, including shard and config server members of sharded clusters; standalone mongod is not. Fixed in 9.0.7, 8.3.16, 8.0.37, 7.0.48, 6.0.30, 5.0.35 and 4.4.32. Atlas clusters get the fix during maintenance. MongoDB found the bug internally and says it isn't aware of attempts to exploit it.

[← Cybersecurity News](/news) · [markdown](/items/mongodb-cve-2026-118383-pre-auth-use-after-free-replica-set-catch-up-crash-9-5.md)

official (MongoDB security announcement, Nov 10, 2026; CVE record/GHSA); MongoDB says it is not aware of exploitation attempts; Datadog reproduced the crash, not code execution

2026-11-12 7:40 AM ET

### MongoDB CVE-2026-118383 (CVSS 9.5): two unauthenticated requests can crash a replica set member when it later becomes primary; patch every member

- **How it works (Datadog Security Labs, via The Hacker News):** two `ping` commands carrying `readConcern.afterOpTime` plant waiters that never expire; if that member later wins an election while lagging, catch-up cleanup runs twice and the new primary segfaults before accepting writes. Turning on authentication doesn't block the two requests on vulnerable versions. The attacker can't force the lag or the election.
- **Fix detail:** in 8.0.37 only system users can use `readConcern.afterOpTime`.
- **Do now:** upgrade every replica set member, including containers and members that were offline; Atlas users who defer maintenance should apply it now; restrict network access to the database meanwhile.
- 8.3.16 also fixes about 20 other MongoDB CVEs (CVE-2026-120803 to -120828).

Sources: [MongoDB Community Hub: Important MongoDB security update available (Action Required), Nov 10, 2026](https://www.mongodb.com/community/forums/t/important-mongodb-security-update-available-action-required-november-10-2026/344843) · [GitHub Advisory GHSA-fjxh-6vgh-cx2c (CVE-2026-118383)](https://github.com/advisories/GHSA-fjxh-6vgh-cx2c) · [The Hacker News: Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on Failover (summarizes Datadog Security Labs' analysis)](https://thehackernews.com/2026/11/critical-pre-auth-mongodb-flaw-cve-2026.html)