MongoDB 3.x — End of Life
EOL Actively exploitedMongoDB 3.x — All releases
| Version | Released | Active support | EOL date | Latest patch | Status | Alert me |
|---|---|---|---|---|---|---|
| 3.6 | Nov 30, 2017 | — | Apr 30, 2021 | 3.6.23 | EOL | |
| 3.4 | Nov 30, 2016 | — | Jan 31, 2020 | 3.4.24 | EOL | |
| 3.2 | Dec 31, 2015 | — | Sep 30, 2018 | 3.2.22 | EOL | |
| 3.0 | Mar 31, 2015 | — | Feb 28, 2018 | 3.0.15 | EOL |
CVEs affecting MongoDB 3.x (5)
| CVE | Severity | CVSS | EPSS | KEV | Cycle | Description | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-9753 | HIGH | 8.1 | 0.30% | — | 3.2 | The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed … | Jun 9, 2026 |
| CVE-2026-9753 | HIGH | 8.1 | 0.30% | — | 3.0 | The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed … | Jun 9, 2026 |
| CVE-2026-9753 | HIGH | 8.1 | 0.30% | — | 3.4 | The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed … | Jun 9, 2026 |
| CVE-2026-9753 | HIGH | 8.1 | 0.30% | — | 3.6 | The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed … | Jun 9, 2026 |
| CVE-2025-14847 | HIGH | 7.5 | 83.01% | KEV | 3.6 | Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthe… | Dec 19, 2025 |
MongoDB 3.x is EOL — migrate to MongoDB 4.x
MongoDB 4.x is the next major release. Plan your upgrade before MongoDB 3.x stops receiving security patches.
Frequently asked questions
Is MongoDB 3 end of life?
Yes. All MongoDB 3.x releases have reached end of life and no longer receive security patches. There are 5 known CVEs affecting MongoDB 3.x. Migrate to MongoDB 4.x as soon as possible.
What CVEs affect MongoDB 3?
There are 5 CVEs tracked for MongoDB 3.x and 1 listed in the CISA Known Exploited Vulnerabilities catalog. See the full list above with CVSS and EPSS scores.
What is the latest MongoDB 3 version?
The latest MongoDB 3.x patch release is 3.6.23, released on March 16, 2021. Always run the latest patch to benefit from all security fixes.
How to migrate from MongoDB 3 to MongoDB 4?
To migrate from MongoDB 3 to MongoDB 4: (1) review the official MongoDB 4 migration guide for breaking changes, (2) update dependencies and configuration accordingly, (3) test thoroughly in a staging environment, (4) deploy with a rollback plan. Starting early gives you time to resolve compatibility issues before your current version reaches end of life.
Is it safe to run MongoDB 3 in production?
No. MongoDB 3 has reached end of life and security vulnerabilities are no longer patched. Critically, 1 CVE affecting MongoDB 3.x is in the CISA KEV catalog — meaning they are actively exploited in the wild. Upgrade to a supported version immediately.
Data sourced from endoflife.date · CVE data from NVD · EPSS from FIRST.org · KEV from CISA