VYPR
Unrated severityNVD Advisory· Published Jul 22, 2026· Updated Jul 23, 2026

Server-Side JavaScript DBPointer BSON Serialization Memory Disclosure

CVE-2026-13066

Description

Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments that use server-side JavaScript.

Affected products

1

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.