Unrated severityNVD Advisory· Published Jul 22, 2026· Updated Jul 23, 2026
Server-Side JavaScript DBPointer BSON Serialization Memory Disclosure
CVE-2026-13066
Description
Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments that use server-side JavaScript.
Affected products
1Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.