After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subsequently crash mongod when the server-side JavaScript engine (through $where, $function, mapreduce reduce stage, etc.) is used also in a specific way, resulting in a post-authentication denial-of-service.
This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
Click to expand
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-8336",
"assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
"assignerShortName": "mongodb",
"dateUpdated": "2026-05-13T00:16:16.568Z",
"dateReserved": "2026-05-11T15:37:59.492Z",
"datePublished": "2026-05-13T00:16:16.568Z",
"state": "PUBLISHED"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
"shortName": "mongodb",
"dateUpdated": "2026-05-13T00:16:16.568Z"
},
"title": "Post-authentication use-after-free error in $_internalJsEmit and mapreduce commands",
"descriptions": [
{
"lang": "en",
"value": "After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subsequently crash mongod when the server-side JavaScript engine (through $where, $function, mapreduce reduce stage, etc.) is used also in a specific way, resulting in a post-authentication denial-of-service.\n\nThis issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subsequently crash mongod when the server-side JavaScript engine (through $where, $function, mapreduce reduce stage, etc.) is used also in a specific way, resulting in a post-authentication denial-of-service.<br><br>This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.<br><br><br><br>"
}
]
}
],
"affected": [
{
"vendor": "MongoDB, Inc.",
"product": "MongoDB Server",
"defaultStatus": "unaffected",
"versions": [
{
"version": "7.0",
"status": "affected",
"versionType": "custom",
"lessThan": "7.0.34"
},
{
"version": "8.0",
"status": "affected",
"versionType": "custom",
"lessThan": "8.0.23"
},
{
"version": "8.2",
"status": "affected",
"versionType": "custom",
"lessThan": "8.2.9"
},
{
"version": "8.3",
"status": "affected",
"versionType": "custom",
"lessThan": "8.3.2"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-416: Use After Free",
"cweId": "CWE-416",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://jira.mongodb.org/browse/SERVER-121610",
"tags": [
"issue-tracking"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH"
}
}
]
}
}
}