CVE-2026-13066 — Server-Side JavaScript DBPointer BSON Serialization Memory Disclosure
Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data…
Published: 2026-07-22 · CVSS: 7.1 · CVSS 4.0
Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments that use server-side JavaScript.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7