CVE-2026-13066
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Jul 22, 2026
Vendor
unknown
Description
Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments that use server-side JavaScript.