MongoDB security advisory (AV26-1024)

Serial Number: AV26-1024
Date: October 9, 2026

As of October 8, 2026, MongoDB is affected by vulnerabilities in the following products:

• Go Driver
  • Prior to 2.9.0
  • Prior to 2.9.2
• libmongocrypt
  • Prior to 1.20.5

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Duplicate masterKey field re-parses into the same KEK
• Reject int32 length overflow in bsoncore.valueLength
• Reject BSON lengths below the 5-byte minimum before slicing
• MongoDB Alerts