Answer in brief
CVE-2026-119179 records a High severity (CVSS 8.3) vulnerability in MongoDB Node.js driver: Connection pool desynchronization after operation timeout can expose other user's data. The current sources do not mark it as known exploited. The current feed maps MongoDB/Node.js Driver (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps MongoDB/Node.js Driver (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| MongoDB/Node.js Drivergeneric | >=6.11.0 <6.22.0 || >=7.0.0 <7.8.0 | 6.22.0, 7.8.0 |
Published upstream
Nov 3, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 3, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 3, 2026
A flaw in the connection management layer of the MongoDB Node.js driver can leave a pooled network connection in the pool for reuse while data from an earlier operation is still outstanding on it. In applications that enable an optional client-side operation timeout, an unauthenticated party that can send ordinary requests to the application may cause database replies to be paired with the wrong requests. This may result in unintended disclosure of other users' records, incorrect operation results being returned, and failures of legitimate requests.
Quoted source text, attributed separately from HOL analysis.