MongoDB Node.js Driver pairs replies with wrong requests after timeout, exposing other users' data
Apps may show other users' database records.
Summary
With the optional client-side operation timeout enabled, the MongoDB Node.js Driver can pair database replies with the wrong requests. An unauthenticated user who can send ordinary requests may see other users' records.
Affected when
- Optional client-side operation timeout enabled
What to do
Affected ranges are 6.11.0 to before 6.22.0 and 7.0.0 to before 7.8.0. Check that the driver you run is newer than these ranges, and read MongoDB's official advisory.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen