MongoDB 6.x — End of Life
EOL Actively exploitedMongoDB 6.x reached end of life on Aug 31, 2023, 1150 days ago, and no longer receives security fixes. The most recent release in this series is 6.3.2. 5 CVEs are tracked for this series, including 1 actively exploited according to CISA KEV. 5 of them were published after the end of life of the affected cycle and will not get an official patch. The next major version is MongoDB 7. See MongoDB 7 →
MongoDB 6.x — All releases
| Version | Released | Active support | EOL date | Latest patch | Status | Alert me |
|---|---|---|---|---|---|---|
| 6.3 | Apr 30, 2023 | — | Aug 31, 2023 | 6.3.2 | EOL | |
| 6.2 | Feb 28, 2023 | — | Apr 24, 2023 | 6.2.1 | EOL | |
| 6.1 | Oct 31, 2022 | — | Feb 9, 2023 | 6.1.1 | EOL | |
| 6.0 | Jul 31, 2022 | — | Jul 31, 2025 | 6.0.29 | EOL |
CVEs affecting MongoDB 6.x (11)
| CVE | Severity | CVSS | EPSS | KEV | Cycle | Description | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-9753 | HIGH | 8.1 | 0.52% | — | 6.0 | The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed … | Jun 9, 2026 |
| CVE-2026-9753 | HIGH | 8.1 | 0.52% | — | 6.3 | The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed … | Jun 9, 2026 |
| CVE-2026-9753 | HIGH | 8.1 | 0.52% | — | 6.1 | The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed … | Jun 9, 2026 |
| CVE-2026-9753 | HIGH | 8.1 | 0.52% | — | 6.2 | The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed … | Jun 9, 2026 |
| CVE-2026-8053 | HIGH | 8.8 | 0.65% | — | 6.0 | An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write priv… | May 13, 2026 |
| CVE-2025-14847 | HIGH | 7.5 | 83.21% | KEV | 6.0 | Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthe… | Dec 19, 2025 |
| CVE-2025-12657 | MEDIUM | 5.0 | — | — | 6.1 | The KMIP response parser built into mongo binaries is overly tolerant of certain malformed packets, and may parse them i… | Nov 3, 2025 |
| CVE-2025-12657 | MEDIUM | 5.0 | — | — | 6.2 | The KMIP response parser built into mongo binaries is overly tolerant of certain malformed packets, and may parse them i… | Nov 3, 2025 |
| CVE-2025-12657 | MEDIUM | 5.0 | — | — | 6.3 | The KMIP response parser built into mongo binaries is overly tolerant of certain malformed packets, and may parse them i… | Nov 3, 2025 |
| CVE-2025-12657 | MEDIUM | 5.0 | — | — | 6.0 | The KMIP response parser built into mongo binaries is overly tolerant of certain malformed packets, and may parse them i… | Nov 3, 2025 |
| CVE-2025-10060 | MEDIUM | 6.5 | 0.37% | — | 6.0 | MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially… | Sep 5, 2025 |
MongoDB 6.x is EOL — migrate to MongoDB 7.x
MongoDB 7.x is the next major release. Plan your upgrade before MongoDB 6.x stops receiving security patches.
Add a MongoDB 6 EOL badge to your README
Show your users which MongoDB version your project runs and whether it is still supported. The badge updates automatically. More formats and options →
[](https://eolcanary.com/explore/mongodb/6)Frequently asked questions
Is MongoDB 6 end of life?
Yes. All MongoDB 6.x releases have reached end of life and no longer receive security patches. There are 5 known CVEs affecting MongoDB 6.x. Migrate to MongoDB 7.x as soon as possible.
What CVEs affect MongoDB 6?
There are 5 CVEs tracked for MongoDB 6.x and 1 listed in the CISA Known Exploited Vulnerabilities catalog. See the full list above with CVSS and EPSS scores.
What is the latest MongoDB 6 version?
The latest MongoDB 6.x patch release is 6.3.2, released on June 28, 2023. Always run the latest patch to benefit from all security fixes.
How to migrate from MongoDB 6 to MongoDB 7?
To migrate from MongoDB 6 to MongoDB 7: (1) review the official MongoDB 7 migration guide for breaking changes, (2) update dependencies and configuration accordingly, (3) test thoroughly in a staging environment, (4) deploy with a rollback plan. Starting early gives you time to resolve compatibility issues before your current version reaches end of life.
Is it safe to run MongoDB 6 in production?
No. MongoDB 6 has reached end of life and security vulnerabilities are no longer patched. Critically, 1 CVE affecting MongoDB 6.x is in the CISA KEV catalog — meaning it is actively exploited in the wild. Upgrade to a supported version immediately.
Data sourced from endoflife.date · CVE data from NVD · EPSS from FIRST.org · KEV from CISA