MongoDB 7.x — End of Life
Active Actively exploited EOL: Oct 2, 20244 releases in this series90 CVEs
MongoDB 7.x is partially supported: only 7.0 still receives security fixes until Aug 31, 2027, in 312 days. The most recent release in this series is 7.3.4. 90 CVEs are tracked for this series, including 1 actively exploited according to CISA KEV. The next major version is MongoDB 8. See MongoDB 8 →
MongoDB 7.x — All releases
| Version | Released | Active support | EOL date | Latest patch | Status | Alert me |
|---|---|---|---|---|---|---|
| 7.3 | Mar 31, 2024 | — | Oct 2, 2024 | 7.3.4 | EOL | |
| 7.2 | Jan 31, 2024 | — | Mar 27, 2024 | 7.2.2 | EOL | |
| 7.1 | Oct 31, 2023 | — | Jan 23, 2024 | 7.1.1 | EOL | |
| 7.0 | Aug 31, 2023 | — | Aug 31, 2027 | 7.0.45 | Active |
CVEs affecting MongoDB 7.x (90)
| CVE | Severity | CVSS | EPSS | KEV | Cycle | Description | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-89099 | HIGH | 7.5 | 0.32% | — | 7.0 | A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the sam… | Sep 11, 2026 |
| CVE-2026-82076 | MEDIUM | 6.5 | 0.41% | — | 7.0 | An integer overflow in the query planning component of MongoDB Server can allow an authenticated user with ordinary data… | Sep 8, 2026 |
| CVE-2026-82075 | HIGH | 7.5 | 0.51% | — | 7.0 | An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router … | Sep 8, 2026 |
| CVE-2026-82074 | MEDIUM | 6.5 | 0.35% | — | 7.0 | MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user wit… | Sep 8, 2026 |
| CVE-2026-82070 | MEDIUM | 6.5 | 0.32% | — | 7.0 | A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privile… | Sep 8, 2026 |
| CVE-2026-82068 | MEDIUM | 6.5 | 0.40% | — | 7.0 | A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal asse… | Sep 8, 2026 |
| CVE-2026-82067 | HIGH | 8.1 | 0.50% | — | 7.0 | Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authoriz… | Sep 8, 2026 |
| CVE-2026-82066 | MEDIUM | 4.3 | 0.38% | — | 7.0 | A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user… | Sep 8, 2026 |
| CVE-2026-82065 | MEDIUM | 6.5 | 0.40% | — | 7.0 | A security issue in the MongoDB Server's storage engine integration layer allows an authenticated user with collection c… | Sep 8, 2026 |
| CVE-2026-82064 | HIGH | 7.5 | 0.51% | — | 7.0 | A security issue in MongoDB Server allows an unauthenticated network user to cause a denial of service on a specific typ… | Sep 8, 2026 |
| CVE-2026-82063 | MEDIUM | 5.3 | 0.36% | — | 7.0 | A use-after-free security issue in the cursor management component of MongoDB Server allows an authenticated user to cau… | Sep 8, 2026 |
| CVE-2026-82060 | MEDIUM | 5.4 | 0.31% | — | 7.0 | In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store d… | Sep 8, 2026 |
| CVE-2026-82059 | MEDIUM | 5.3 | 0.36% | — | 7.0 | An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user … | Sep 8, 2026 |
| CVE-2026-82058 | MEDIUM | 6.5 | 0.40% | — | 7.0 | A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges … | Sep 8, 2026 |
| CVE-2026-82056 | MEDIUM | 5.3 | 0.33% | — | 7.0 | A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert … | Sep 8, 2026 |
| CVE-2026-82054 | MEDIUM | 6.5 | 0.40% | — | 7.0 | A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a … | Sep 8, 2026 |
| CVE-2026-82053 | HIGH | 8.1 | 0.41% | — | 7.0 | A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authe… | Sep 8, 2026 |
| CVE-2026-82052 | MEDIUM | 6.5 | 0.49% | — | 7.0 | The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a Mon… | Sep 8, 2026 |
| CVE-2026-18712 | HIGH | 8.1 | 0.17% | — | 7.0 | An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileg… | Aug 11, 2026 |
| CVE-2026-18711 | HIGH | 7.1 | 0.49% | — | 7.0 | An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to … | Aug 11, 2026 |
| CVE-2026-18709 | MEDIUM | 6.4 | 0.19% | — | 7.0 | An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit … | Aug 11, 2026 |
| CVE-2026-18708 | MEDIUM | 6.4 | 0.38% | — | 7.0 | An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to caus… | Aug 11, 2026 |
| CVE-2026-18707 | MEDIUM | 4.3 | 0.25% | — | 7.0 | An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the se… | Aug 11, 2026 |
| CVE-2026-18705 | MEDIUM | 6.5 | 0.36% | — | 7.0 | An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view … | Aug 11, 2026 |
| CVE-2026-18702 | MEDIUM | 6.4 | 0.27% | — | 7.0 | An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnost… | Aug 11, 2026 |
| CVE-2026-18701 | MEDIUM | 6.5 | 0.40% | — | 7.0 | An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server … | Aug 11, 2026 |
| CVE-2026-18700 | MEDIUM | 6.5 | 0.40% | — | 7.0 | An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an i… | Aug 11, 2026 |
| CVE-2026-18699 | MEDIUM | 6.5 | 0.40% | — | 7.0 | An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the ser… | Aug 11, 2026 |
| CVE-2026-18698 | MEDIUM | 5.4 | 0.24% | — | 7.0 | An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action ag… | Aug 11, 2026 |
| CVE-2026-18697 | HIGH | 7.5 | 0.44% | — | 7.0 | An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) proce… | Aug 11, 2026 |
| CVE-2026-18696 | MEDIUM | 6.5 | 0.40% | — | 7.0 | An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default privileges to … | Aug 11, 2026 |
| CVE-2026-18695 | MEDIUM | 6.5 | 0.40% | — | 7.0 | An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaField could… | Aug 11, 2026 |
| CVE-2026-18694 | HIGH | 7.1 | 0.39% | — | 7.0 | An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileges to caus… | Aug 11, 2026 |
| CVE-2026-18693 | HIGH | 7.6 | 0.34% | — | 7.0 | An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges … | Aug 11, 2026 |
| CVE-2026-18691 | HIGH | 8.8 | 0.35% | — | 7.0 | An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influenc… | Aug 11, 2026 |
| CVE-2026-18690 | HIGH | 8.1 | 0.40% | — | 7.0 | An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action ag… | Aug 11, 2026 |
| CVE-2026-18688 | HIGH | 7.1 | 0.39% | — | 7.0 | An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-bounds memory … | Aug 11, 2026 |
| CVE-2026-9737 | MEDIUM | 6.5 | 0.42% | — | 7.0 | During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the m… | Jul 22, 2026 |
| CVE-2026-13078 | HIGH | 7.7 | 0.34% | — | 7.0 | A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered… | Jul 22, 2026 |
| CVE-2026-13077 | HIGH | 7.1 | 0.42% | — | 7.0 | A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read… | Jul 22, 2026 |
| CVE-2026-13074 | MEDIUM | 5.3 | 0.44% | — | 7.0 | An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combinati… | Jul 22, 2026 |
| CVE-2026-13072 | HIGH | 8.1 | 0.40% | — | 7.0 | When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data du… | Jul 22, 2026 |
| CVE-2026-13071 | MEDIUM | 6.5 | 0.42% | — | 7.0 | An authenticated user with read access can cause the mongod process to be terminated through certain aggregation express… | Jul 22, 2026 |
| CVE-2026-13070 | MEDIUM | 5.3 | 0.13% | — | 7.0 | A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP respons… | Jul 22, 2026 |
| CVE-2026-13069 | MEDIUM | 6.5 | 0.29% | — | 7.0 | An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a c… | Jul 22, 2026 |
| CVE-2026-13068 | MEDIUM | 4.2 | 0.25% | — | 7.0 | An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate ac… | Jul 22, 2026 |
| CVE-2026-13066 | MEDIUM | 6.5 | 0.36% | — | 7.0 | Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result i… | Jul 22, 2026 |
| CVE-2026-13065 | MEDIUM | 6.5 | 0.49% | — | 7.0 | A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator… | Jul 22, 2026 |
| CVE-2026-13062 | MEDIUM | 6.5 | 0.18% | — | 7.0 | An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal … | Jul 22, 2026 |
| CVE-2026-13061 | MEDIUM | 4.3 | 0.27% | — | 7.0 | An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessi… | Jul 22, 2026 |
| CVE-2026-13060 | MEDIUM | 6.5 | 0.42% | — | 7.0 | An authenticated user with limited read privileges may be able to access documents from collections they are not authori… | Jul 22, 2026 |
| CVE-2026-13059 | HIGH | 8.1 | 0.38% | — | 7.0 | An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role… | Jul 22, 2026 |
| CVE-2026-13055 | MEDIUM | 6.5 | 0.40% | — | 7.0 | The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod)… | Jul 22, 2026 |
| CVE-2026-9753 | HIGH | 8.1 | 0.52% | — | 7.0 | The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed … | Jun 9, 2026 |
| CVE-2026-9752 | MEDIUM | 6.5 | 0.47% | — | 7.0 | An authorized user could trigger a server crash by running a query with a 2dsphere index on a field that stores a GeoJSO… | Jun 9, 2026 |
| CVE-2026-9751 | MEDIUM | 5.5 | 0.15% | — | 7.0 | The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mon… | Jun 9, 2026 |
| CVE-2026-9750 | MEDIUM | 6.5 | 0.56% | — | 7.0 | An authenticated user can cause a MongoDB server to crash or return incorrect results by creating documents that interfe… | Jun 9, 2026 |
| CVE-2026-9749 | MEDIUM | 6.5 | 0.47% | — | 7.0 | This issue can occur when running an aggregation pipeline that uses the internal $exchange stage configured with key-ran… | Jun 9, 2026 |
| CVE-2026-9748 | MEDIUM | 6.5 | 0.56% | — | 7.0 | The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index st… | Jun 9, 2026 |
| CVE-2026-9747 | MEDIUM | 6.5 | 0.47% | — | 7.0 | Adding fromRouter:true and runtimeConstants.userRoles could cause aggregations to crash mongodb server. | Jun 9, 2026 |
| CVE-2026-9746 | MEDIUM | 6.5 | 0.47% | — | 7.0 | When using $changestreams and $_requestReshardingResumeToken with the exchange option the server hits an invariant which… | Jun 9, 2026 |
| CVE-2026-9741 | MEDIUM | 6.5 | 0.15% | — | 7.0 | A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side F… | Jun 9, 2026 |
| CVE-2026-9740 | HIGH | 7.5 | 0.53% | — | 7.0 | A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod process by … | Jun 9, 2026 |
| CVE-2026-8843 | MEDIUM | 6.5 | 0.42% | — | 7.0 | Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to ins… | May 18, 2026 |
| CVE-2026-8202 | MEDIUM | 4.3 | 0.45% | — | 7.0 | Using a densely populated chars mask and a large input string in the MongoDB aggregation operators $trim, $ltrim, and $r… | May 13, 2026 |
| CVE-2026-8201 | MEDIUM | 6.4 | 0.21% | — | 7.0 | A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting clie… | May 13, 2026 |
| CVE-2026-8200 | LOW | 2.7 | 0.34% | — | 7.0 | When schema validation is enabled on a collection and an update or insert would violate the collection's schema, the loc… | May 13, 2026 |
| CVE-2026-8199 | MEDIUM | 6.5 | 0.45% | — | 7.0 | An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAny… | May 13, 2026 |
| CVE-2026-8053 | HIGH | 8.8 | 0.65% | — | 7.0 | An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write priv… | May 13, 2026 |
| CVE-2026-6915 | MEDIUM | 6.3 | 0.28% | — | 7.0 | An authorization flaw in the user management command could allow an authenticated user to make limited changes to authen… | Apr 29, 2026 |
| CVE-2026-6914 | MEDIUM | 6.5 | 0.44% | — | 7.0 | Computing the MD5 checksum of a malformed BSON object under specific conditions may cause loss of availability in MongoD… | Apr 29, 2026 |
| CVE-2026-5170 | MEDIUM | 5.3 | 0.33% | — | 7.0 | A user with access to the cluster with a limited set of privilege actions can trigger a crash of a mongod process during… | Mar 30, 2026 |
| CVE-2026-4358 | MEDIUM | 6.4 | 0.37% | — | 7.0 | A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-fre… | Mar 17, 2026 |
| CVE-2026-4148 | HIGH | 8.8 | 0.57% | — | 7.0 | A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who issu… | Mar 17, 2026 |
| CVE-2026-4147 | MEDIUM | 6.5 | 0.37% | — | 7.0 | An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted is… | Mar 17, 2026 |
| CVE-2026-25613 | MEDIUM | 6.5 | 0.48% | — | 7.0 | An authorized user may disable the MongoDB server by issuing a query against a collection that contains an invalid compo… | Feb 10, 2026 |
| CVE-2026-25610 | MEDIUM | 6.5 | 0.48% | — | 7.0 | An authorized user may trigger a server crash by running a $geoNear pipeline with certain invalid index hints. | Feb 10, 2026 |
| CVE-2026-25609 | MEDIUM | 5.4 | 0.33% | — | 7.0 | Incorrect validation of the profile command may result in the determination that a request altering the 'filter' is read… | Feb 10, 2026 |
| CVE-2026-1849 | MEDIUM | 6.5 | 0.31% | — | 7.0 | MongoDB Server may experience an out-of-memory failure while evaluating expressions that produce deeply nested documents… | Feb 10, 2026 |
| CVE-2026-1848 | HIGH | 7.5 | 0.30% | — | 7.0 | Connections received from the proxy port may not count towards total accepted connections, resulting in server crashes i… | Feb 10, 2026 |
| CVE-2026-1847 | MEDIUM | 6.5 | 0.28% | — | 7.0 | Inserting certain large documents into a replica set could lead to replica set secondaries not being able to fetch the o… | Feb 10, 2026 |
| CVE-2025-14847 | HIGH | 7.5 | 83.21% | KEV | 7.0 | Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthe… | Dec 19, 2025 |
| CVE-2025-14345 | MEDIUM | 4.2 | 0.21% | — | 7.0 | A post-authentication flaw in the network two-phase commit protocol used for cross-shard transactions in MongoDB Server … | Dec 9, 2025 |
| CVE-2025-13644 | MEDIUM | 6.5 | — | — | 7.0 | MongoDB Server may experience an invariant failure during batched delete operations when handling documents. The issue a… | Nov 25, 2025 |
| CVE-2025-13643 | LOW | 3.1 | — | — | 7.0 | A user with access to the cluster with a limited set of privilege actions may be able to terminate queries that are bein… | Nov 25, 2025 |
| CVE-2025-13507 | MEDIUM | 6.5 | — | — | 7.0 | Inconsistent object size validation in time series processing logic may result in later processing of oversized BSON doc… | Nov 25, 2025 |
| CVE-2025-12893 | MEDIUM | 4.2 | — | — | 7.0 | Clients may successfully perform a TLS handshake with a MongoDB server despite presenting a client certificate not align… | Nov 25, 2025 |
| CVE-2025-12657 | MEDIUM | 5.0 | — | — | 7.0 | The KMIP response parser built into mongo binaries is overly tolerant of certain malformed packets, and may parse them i… | Nov 3, 2025 |
| CVE-2025-11979 | MEDIUM | 5.3 | 0.26% | — | 7.0 | An authorized user may crash the MongoDB server by causing buffer over-read. This can be done by issuing a DDL operation… | Oct 20, 2025 |
| CVE-2025-10060 | MEDIUM | 6.5 | 0.37% | — | 7.0 | MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially… | Sep 5, 2025 |
MongoDB 7.x will reach end of life — migrate to MongoDB 8.x
MongoDB 8.x is the next major release. Plan your upgrade before MongoDB 7.x stops receiving security patches.
Add a MongoDB 7 EOL badge to your README
Show your users which MongoDB version your project runs and whether it is still supported. The badge updates automatically. More formats and options →
[](https://eolcanary.com/explore/mongodb/7)Frequently asked questions
Is MongoDB 7 end of life?
Partially. 3 of the 4 MongoDB 7.x releases have reached end of life. Still supported: 7.0 (until August 31, 2027 at the latest).
What CVEs affect MongoDB 7?
There are 90 CVEs tracked for MongoDB 7.x and 1 listed in the CISA Known Exploited Vulnerabilities catalog. See the full list above with CVSS and EPSS scores.
What is the latest MongoDB 7 version?
The latest MongoDB 7.x patch release is 7.3.4, released on August 14, 2024. Always run the latest patch to benefit from all security fixes.
How to migrate from MongoDB 7 to MongoDB 8?
To migrate from MongoDB 7 to MongoDB 8: (1) review the official MongoDB 8 migration guide for breaking changes, (2) update dependencies and configuration accordingly, (3) test thoroughly in a staging environment, (4) deploy with a rollback plan. Starting early gives you time to resolve compatibility issues before your current version reaches end of life.
Is it safe to run MongoDB 7 in production?
Only on a supported release (7.0). Support for MongoDB 7.0 ends on August 31, 2027. Make sure you run the latest patch (7.0.45) to have all security fixes applied.
Data sourced from endoflife.date · CVE data from NVD · EPSS from FIRST.org · KEV from CISA