MONGODB has issued advisories covering seven vulnerabilities across its official drivers and related tools. The issues include five rated high severity and two medium severity; the highest listed rating is 8.4 for CVE-2026-96749. No active exploitation or public proof-of-concept code has been confirmed, according to the supplied report.
The flaws affect several components. CVE-2026-96748 allows crafted, percent-encoded connection-string hostnames to redirect connections to rogue database servers, potentially exposing authentication handshakes and queries. CVE-2026-96749 is a signed integer overflow in PyMongo’s native BSON encoder that can cause a heap out-of-bounds write when unusually large data is processed.
Other issues include a heap buffer overflow in C Driver topology monitoring (CVE-2026-96746), PHP object injection through command-monitoring events (CVE-2026-96745), and shell-script injection in MongoDB Compass’s embedded shell (CVE-2026-96750). Additional vulnerabilities affect Laravel integration and client-side field encryption.
Administrators and developers should update affected components. PyMongo should be upgraded to 4.18.2 or later; the C Driver to 1.30.12 or 2.5.5; the PHP Driver to 1.21.10, 2.1.10 or 2.5.3; MongoDB Compass to 1.49.12; and Laravel MongoDB to 5.11.0. The report directs users to MongoDB’s security alerts for complete update instructions.