CVE-2026-82057

MongoDB is vulnerable to a denial-of-service flaw in which an authenticated user holding readWrite privileges can crash the mongod server process. The crash is triggered when the user specifies a custom WiredTiger storage configuration option with an incompatible value during collection creation, causing type confusion (CWE-843) in the storage engine layer; when documents are subsequently read from the misconfigured collection, memory is misinterpreted and the server crashes. An attacker gains availability impact only (no data disclosure or modification), but the crafted collection configuration persists across restarts, so recovery requires manual operator intervention. Any MongoDB deployment that grants readWrite access to users or application service accounts that are not fully trusted is affected, and no specific affected version ranges are provided in the available data. Exploitation has not been observed: there is no public proof-of-concept, the flaw is not in CISA's KEV, and EPSS estimates only a 0.3% probability of exploitation in the next 30 days.

What to do: Check MongoDB's security advisory for the affected version ranges and upgrade to the patched release once identified. Until then, restrict readWrite privileges to fully trusted accounts and audit collections created with custom WiredTiger configuration options for incompatible values. Remember that a crafted collection configuration survives restarts, so if a server crashes, remediate by correcting the collection's storage options or dropping and recreating the affected collection manually.