MongoDB patches CVE-2026-118383 use-after-free crash

Researchers have discovered a critical use-after-free vulnerability, designated CVE-2026-118383, in MongoDB Server's primary catch-up process with a CVSS v4.0 score of 9.5. The vulnerability allows unauthenticated remote clients to crash vulnerable replica set members by planting stale waiters using ping requests before an election. MongoDB has released patches across multiple supported server branches and urges users to upgrade promptly or restrict network access as a temporary mitigation. Open article →