CVE-2026-119179

{
  "etk_id": "ETK-2026-3370",
  "cve_id": "CVE-2026-119179",
  "display_id": "CVE-2026-119179",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-115819",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Connection pool desynchronization in MongoDB Node.js Driver",
  "summary": "MongoDB Node.js Driver applications using the optional client-side operation timeout are affected by a connection-pool synchronization issue. An unauthenticated requester who can make ordinary application requests may cause responses to be associated with different requests, potentially exposing another user's data or causing incorrect results and failed requests.",
  "mitigation": "Upgrade the MongoDB Node.js Driver to version 6.22.0 or 7.8.0, as appropriate for your release line. Until upgraded, disable the optional client-side operation timeout to reduce exposure.",
  "vendor": "MongoDB",
  "product": "Node.js Driver",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 6.11.0, < 6.22.0",
        ">= 7.0.0, < 7.8.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "6.22.0",
        "7.8.0"
      ],
      "package_name": "Node.js Driver",
      "purl": null
    }
  ],
  "cwes": [
    226
  ],
  "cvss_score": 8.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 32.7591409,
  "t0_at": "2026-11-03T13:33:39.466000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-03T13:33:39.466000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-03T13:33:39.466000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-119179"
    }
  }
}