---
title: Tip: schedule MongoDB 7.0.45 / 8.0.34 / 8.3.13 (and 9.x RC fixes) after CERTFR-2026-AVI-1304 | ctxsec
url: https://ctxsec.com/items/tip-mongodb-oct-2026-patch
description: ""
status: "how-to"
published: 2026-10-15
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-mongodb-oct-2026-patch.md)

how-to

2026-10-15

### Tip: schedule MongoDB 7.0.45 / 8.0.34 / 8.3.13 (and 9.x RC fixes) after CERTFR-2026-AVI-1304

Inventory self-hosted mongod/mongos versions and jump to 7.0.45, 8.0.34, 8.3.13, or the fixed 9.x line from MongoDB—do not stay on RCs CERT-FR still lists as vulnerable. On replica sets, rolling-upgrade secondaries first; on sharded clusters, follow MongoDB's upgrade order for config servers and mongos. Confirm Atlas projects are on a patched patch-line if you are not on auto Latest Release. After upgrade, watch for unusual aggregation shapes that historically hit query-engine memory bugs, and keep authentication + network exposure controls in place (these CVEs are not an excuse to delay that hygiene).

Sources: [CERTFR-2026-AVI-1304](https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1304/) · [MongoDB 8.0.34 notes](https://www.mongodb.com/docs/manual/release-notes/8.0/#8.0.34---oct-13--2026)