CVE-2026-8336: MongoDB

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subsequently crash mongod when the server-side JavaScript engine (through $where, $function, mapreduce reduce stage, etc.) is used also in a specific way, resulting in a post-authentication denial-of-service. This issue impacts MongoDB Server v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

Affected products

• MongoDB MongoDB: from 8.2.0, before 8.2.9 (fixed in 8.2.9); from 8.3.0, before 8.3.2 (fixed in 8.3.2)

Published 2026-05-13. Last modified 2026-06-17.