CVE-2026-8202

4.3

MEDIUMCVSS v3

Published

May 13, 2026

Affected

7 projects

Assigned by

[email protected]

Severity scale

010

Description

Using a densely populated chars mask and a large input string in the MongoDB aggregation operators $trim, $ltrim, and $rtrim, an authenticated user with aggregation permissions can pin CPU utilization at 100% for an extended period of time. This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

mongodb

NPMThe official MongoDB driver for Node.js

>= 7.0.0, < 7.0.34, >= 8.0.0, < 8.0.23, >= 8.2.0, < 8.2.9, >= 8.3.0, < 8.3.2NVD

@types/mongodb

NPMStub TypeScript definitions entry for mongodb, which provides its own types definitions

>= 7.0.0, < 7.0.34, >= 8.0.0, < 8.0.23, >= 8.2.0, < 8.2.9, >= 8.3.0, < 8.3.2NVD

bitnami/mongodb

More on this CVE

NVD↗GitHub Advisory↗

Docker Hub

Bitnami Secure Image for mongodb

>= 7.0.0, < 7.0.34, >= 8.0.0, < 8.0.23, >= 8.2.0, < 8.2.9, >= 8.3.0, < 8.3.2NVD

mongodb

Crates.ioThe official MongoDB driver for Rust

>= 7.0.0, < 7.0.34, >= 8.0.0, < 8.0.23, >= 8.2.0, < 8.2.9, >= 8.3.0, < 8.3.2NVD

MongoDB

ChocolateyMongoDB (from "humongous") is a scalable, high-performance, open source NoSQL database written in C++. MongoDB stores data using a flexible document data model that is similar to JSON. Documents contain one or more fields, including arrays, binary data and sub-documents. Fields can vary from document to document. This flexibility allows development teams to evolve the data model rapidly as their application requirements change. Developers access documents through rich, idiomatic drivers available in all popular programming languages. Documents map naturally to the objects in modern languages, which allows developers to be extremely productive. Typically, there’s no need for an ORM layer. #### Package Parameters The following package parameters can be set: * `/dataPath:` - where MongoDB stores its database files - defaults to "$env:ProgramData\MongoDB\data\db" * `/logPath:` - where MongoDB stores its logs - defaults to "$env:ProgramData\MongoDB\log" To pass parameters, use `--params "''"` (e.g. `choco install packageID [other options] --params="'/ITEM:value /ITEM2:value2 /FLAG_BOOLEAN'"`). To have choco remember parameters on upgrade, be sure to set `choco feature enable -n=useRememberedArgumentsForUpgrades`. **Please Note**: This is an automatically updated package. If you find it is out of date by more than a day or two, please contact the maintainer(s) and let them know [here](https://github.com/mkevenaar/chocolatey-packages/issues) that the package is no longer updating correctly.

>= 7.0.0, < 7.0.34, >= 8.0.0, < 8.0.23, >= 8.2.0, < 8.2.9, >= 8.3.0, < 8.3.2NVD

mongodb

RubyGemsPersistence for any Ruby Object & Driver enhancements for MongoDB.

>= 7.0.0, < 7.0.34, >= 8.0.0, < 8.0.23, >= 8.2.0, < 8.2.9, >= 8.3.0, < 8.3.2NVD

bitnamilegacy/mongodb

Docker HubLegacy Bitnami images (no longer updated)

>= 7.0.0, < 7.0.34, >= 8.0.0, < 8.0.23, >= 8.2.0, < 8.2.9, >= 8.3.0, < 8.3.2NVD

Security Advisories

CVE-2026-8202

Description

More on this CVE