| Package | Affected versions | Patched versions |
|---|---|---|
| mongodb | ≥ 8.2.0, < 8.2.9≥ 8.3.0, < 8.3.2 | 8.2.98.3.2 |
After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subsequently crash mongod when the server-side JavaScript engine (through $where, $function, mapreduce reduce stage, etc.) is used also in a specific way, resulting in a post-authentication denial-of-service. This issue impacts MongoDB Server v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free