CVE-2026-81525

Summary

mongodb: Reject "." and NUL bytes in database and collection names

Severity

high

CVSS

8.1

EPSS

0.3% (p19)

CWE

CWE-943

Also known as

GHSA-65fr-j4p9-vc33

Published

2026-09-08

Updated

2026-09-08

Advisory details

Impact

Passing untrusted input as part of a database or collection name may result in targeting a different database or collection than specified.

Patches

Fixed in PHP library 1.21.4 and 2.4.1.

Workarounds

Validate database and collection names prior to passing into APIs.

References

• https://github.com/advisories/GHSA-65fr-j4p9-vc33
• https://github.com/mongodb/mongo-php-library/security/advisories/GHSA-65fr-j4p9-vc33
• https://nvd.nist.gov/vuln/detail/CVE-2026-81525
• https://github.com/mongodb/mongo-php-library/pull/1967
• https://github.com/mongodb/mongo-php-library/pull/1968
• https://github.com/mongodb/mongo-php-library/commit/3a462213bb4fd46efa58a1937b06b1b0553b67a7
• https://github.com/mongodb/mongo-php-library/commit/6f305a3b21740080255a3093b12458274c7cc8ca
• https://github.com/mongodb/mongo-php-driver/releases/tag/1.21.6

Related advisories

• CVE-2026-54350 — critical · npm/@budibase/server
• CVE-2026-55253 — high · PyPI/langgraph-checkpoint-mongodb
• GHSA-qw6m-8fw2-2v64 — high · npm/@budibase/server
• CVE-2026-44840 — high · Go/github.com/dgraph-io/dgraph/v25
• GHSA-pqh8-p93p-2rx7 — medium · npm/@dynatrace-oss/dynatrace-mcp-server
• GHSA-5c7w-4wm3-85vw — medium · npm/@asymmetric-effort/specifyjs

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity