CVE-2026-8336 Details
Description
After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subsequently crash mongod when the server-side JavaScript engine (through $where, $function, mapreduce reduce stage, etc.) is used also in a specific way, resulting in a post-authentication denial-of-service. This issue impacts MongoDB Server v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
A denial-of-service vulnerability has been identified in MongoDB Server versions 7.0 prior to 7.0.34, 8.0 prior to 8.0.23, 8.2 prior to 8.2.9, and 8.3 prior to 8.3.2. The issue arises when an authenticated user invokes the $_internalJsEmit function, which is not meant to be directly accessed, or uses the map function of the mapreduce command in a specific manner. This can lead to a crash of the mongod process when the server-side JavaScript engine is used in certain ways, such as through $where, $function, or the mapreduce reduce stage, causing a post-authentication denial-of-service condition.
Users can upgrade to MongoDB Server versions 8.2.8, 8.3.0-rc4, or 8.2.9 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://jira.mongodb.org/browse/SERVER-121610 | [email protected] | Issue TrackingVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| mongodb mongodb | >= 8.2.0, < 8.2.9 >= 8.3.0, < 8.3.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 18, 2026 | Initial Analysis | [email protected] |
| May 15, 2026 | CVE Modified | [email protected] |
| May 13, 2026 | New CVE Received | [email protected] |