---
id: CVE-2026-119179
title: >-
  MongoDB Node.js driver: Connection pool desynchronization after operation
  timeout can expose other user's data
summary: >-
  A flaw in the connection management layer of the MongoDB Node.js driver can
  leave a pooled network connection in the pool for reuse while data from an
  earlier operation is still outstanding on it. In applications that enable an
  optional …
severity: high
cvss: 7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-226
vendor: MongoDB
product: Node.js Driver
affected:
  - node.js_driver >= 6.11.0 < 6.22.0
  - node.js_driver >= 7.0.0 < 7.8.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-03T18:17:19.307519Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T18:17:31.329Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119179'
references:
  - url: 'https://jira.mongodb.org/browse/NODE-7958'
tags:
  - cve.org
epss: 0.00304
epssPercentile: 0.23294
ingestedAt: '2026-11-05T20:33:06.342Z'
---

## Overview

A flaw in the connection management layer of the MongoDB Node.js driver can leave a pooled network connection in the pool for reuse while data from an earlier operation is still outstanding on it. In applications that enable an optional client-side operation timeout, an unauthenticated party that can send ordinary requests to the application may cause database replies to be paired with the wrong requests. This may result in unintended disclosure of other users' records, incorrect operation results being returned, and failures of legitimate requests.

## Affected

- `node.js_driver >= 6.11.0 < 6.22.0`
- `node.js_driver >= 7.0.0 < 7.8.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.