# MongoDB Node.js driver: DNS responses can redirect database connections Canonical: https://www.oktsec.com/radar/mongodb-nodejs-driver-cve-2026-126837 Publisher: Oktsec Language: en Published: 2026-11-14T14:21:38Z Updated: 2026-11-14T14:21:38Z Record reviewed: 2026-11-14T14:21:38Z Latest evidence check: 2026-11-14T14:21:38Z Disclosed: 2026-11-12 A flaw in SRV hostname validation can redirect an application’s database traffic if an attacker controls the DNS response. TLS does not independently stop this because validation follows the redirected hostname. ## Evidence and response priority - Category: Vulnerability - Oktsec priority: Review this week - Rationale: The manufacturer identifies a corrected boundary and a DNS response prerequisite. The reviewed sources do not establish exploitation. - Evidence: No attacks reported - Verification: Vendor confirmed - Fix status: Fix available - Exposure requirement: Application or configuration dependent - Vendor: MongoDB - Products: MongoDB Node.js driver - CVEs: CVE-2026-126837 ## Technical overview Special characters in an SRV target create a mismatch between the hostname checked and the address used. Possible consequences include credential or application data disclosure and altered query results. This concerns the client driver, not the separately tracked MongoDB replication flaw. No attacks are established in the reviewed manufacturer record. Version 7.8.0 was released on October 30; its current release notes identify the SRV issue. The CNA record was published on November 12. Version 7.8.0 also changes timeout behavior: timeoutMS and timeoutMode become ineffective. Migrate the application’s timeout settings and test compatibility rather than assuming an unchanged configuration still enforces deadlines. ## Recommended response Update the Node.js driver to 7.8.0 or later and redeploy applications using mongodb+srv. Check DNS integrity and investigate unexpected database destinations. Relevant to: Developers and operators using the MongoDB driver in Node.js applications. ## CVE attribution - CVE-2026-126837: MongoDB — MongoDB Node.js driver. [Source](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126837.json) ## Affected systems and fixes ### MongoDB Node.js driver Affected: 3.3.3 through releases before 7.8.0, using mongodb+srv connection strings. An attacker must be able to forge or modify the DNS SRV response. Fixed release / action: 7.8.0 or later Confirm the running version against the vendor advisory, including any distribution backports. ## CISA KEV evidence Catalog: 2026.11.13 Checked: 2026-11-14T16:03:56.845Z No matching CVE appears in the reviewed catalog snapshot. CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America. ## Supporting evidence Snapshot checked: 2026-11-14T21:07:37.491Z. These dates do not change the incident’s editorial review date. ### FIRST EPSS forecast - [CVE-2026-126837](https://api.first.org/data/v1/epss?cve=CVE-2026-126837): 0.21% probability of observed exploitation in the next 30 days; percentile 10.6%; score date 2026-11-14. EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-11-14T21:07:37.491Z. ### Official regional advisories - [Vulnerabilidad en productos MongoDB](https://www.cert.gov.py/vulnerabilidad-en-productos-mongodb-6/) — CERT-PY, Paraguay; publication 2026-11-13T12:10:28.000Z; observed 2026-11-14T21:07:37.491Z; matched by exact CVE identifier. Publisher country does not establish victim location. Original notices may repeat the same underlying advisory. ## Response checklist 1. **Check runtime dependencies** — Identify deployed driver versions and connection string schemes. mongodb:// connections are outside the reported scope. 2. **Update deployed applications** — Upgrade the driver, validate compatibility and redeploy the application. Updating the database server alone does not replace the driver. 3. **Migrate timeout settings** — In 7.8.0, timeoutMS and timeoutMode no longer enforce timeouts. Review serverSelectionTimeoutMS, waitQueueTimeoutMS, socketTimeoutMS and maxTimeMS as appropriate; test operation limits after upgrading. Retain safe SRV host validation. 4. **Review unexpected destinations** — Oktsec recommends preserving DNS and connection records. If evidence indicates redirection, assess exposed credentials and application data. ## Relevance to AI environments Inventory application dependencies, rather than only database server versions. ## Sources - [MongoDB CNA record: affected driver and DNS prerequisite](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126837.json) — MongoDB (CNA record); Vendor notice; checked 2026-11-14T14:21:38Z - [Driver 7.8.0: SRV correction and timeout migration](https://github.com/mongodb/node-mongodb-native/releases/tag/v7.8.0) — MongoDB; Vendor notice; checked 2026-11-14T14:21:38Z ## Editorial record - 2026-11-14T14:21:38Z: Added verified scope, correction and evidence limits from primary sources. ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/mongodb-nodejs-driver-cve-2026-126837) · [Build a response plan](https://www.oktsec.com/radar/mongodb-nodejs-driver-cve-2026-126837#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=mongodb-nodejs-driver-cve-2026-126837&service=exposure_check) - [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=mongodb-nodejs-driver-cve-2026-126837&service=patch_verification) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.