CVE-2026-119179
Description
A flaw was found in the MongoDB Node.js driver. This vulnerability allows an unauthenticated remote attacker to trigger information disclosure, incorrect data processing, or service disruption in applications that enable client-side operation timeouts. Because network connections can be returned to the connection pool and reused while responses from earlier operations are still pending, database replies may be paired with the wrong client requests.
Statement
This vulnerability is evaluated as having a Moderate impact for Red Hat products because successful exploitation requires specific asynchronous race conditions and relies on optional client-side operation timeout settings. Within Red Hat environments, such as containerized services in OpenShift Data Foundation and OpenShift Serverless, the driver is utilized internally, limiting direct exposure to arbitrary caller manipulation. Furthermore, attackers cannot reliably target specific database records, as the misassociation of incoming responses depends on random traffic volume and socket recycling timing.
Mitigation
--- CME Mitigation Guidance (2026-11-04) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to disable client-side operation timeouts (timeoutMS) in MongoDB Node.js driver connection configurations: upgrade to mongodb 6.22.0 or 7.8.0 (or the fixed Odf4/Mcg Core Rhel/Openshift Serverless 1/Logic Rhel9 Operator builds), which ignore the timeoutMS option as a no-op during option parsing, closing all 2 injection vectors (request-response desynchronization via timed-out connection reuse, concurrent application requests triggering client-side operation timeouts). Until patched, this is a concern on Applications running MongoDB Node.js driver versions 6.11.0-6.21.x or 7.0.0-7.7.x that enable client-side operation timeouts (timeoutMS), so Remove or avoid configuring the timeoutMS client-side operation timeout option across all application database client instances. These controls limit blast radius and contain exploitation, but they do not fix the underlying connection pool desynchronization defect — apply the upstream patch to fully remediate.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7 | N/A | 7 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | Low | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data
Data can "bleed" from one session to another through member variables of singleton objects, such as Servlets, and objects from a shared pool. Storing user data in Servlet member fields introduces a data access race condition.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
