Karen IT Security Response Center (KSRC) Advisory

Advisory ID: KSRC-2026-11152 | Publication Date: 15 November 2026

MongoDB Node.js Driver Connection Redirect via Crafted SRV Hostname
CVE-2026-126837

Summary

A critical validation flaw has been identified in the DNS SRV host discovery logic of the MongoDB Node.js Driver. Tracked as CVE-2026-126837, the issue allows an attacker who can forge or modify DNS SRV responses to redirect a client’s database connection to a host under their control.

The vulnerability has been assigned a CVSS v4.0 score of 9.1 (Critical). Successful exploitation can lead to disclosure of application data and authentication credentials, as well as altered query results. Only applications using mongodb+srv:// connection strings are affected. The issue is fixed in driver version 7.8.0.

Technical Overview

When an application connects using a mongodb+srv:// URI, the driver resolves DNS SRV records and validates that each returned hostname belongs to the expected parent domain. After validation, however, the driver constructs the actual connection address from the original (unnormalized) name returned by DNS.

Certain special characters in the SRV target can cause the hostname to be truncated earlier than expected. As a result, the driver may connect to a different host than the one that passed the domain check. Because the TLS certificate is verified against the redirected hostname, TLS does not prevent the attack.

An unauthenticated party who can forge or alter the DNS SRV response (for example via a compromised resolver, hostile network path, or DNS misconfiguration) can therefore redirect database traffic to a host they control. Applications that use plain mongodb:// connection strings are not affected.

Affected Systems

• MongoDB Node.js Driver (mongodb npm package) versions 3.3.3 through before 7.8.0
• Applications that connect using mongodb+srv:// URIs (common with MongoDB Atlas and many cloud deployments)

Fixed version: 7.8.0

Applications using only mongodb:// connection strings are not vulnerable to this specific issue.

Exploitation Status

• Public disclosure on 12 November 2026.
• Public proof-of-concept material has been reported.
• Exploitation requires the ability to influence or forge DNS SRV responses; it is not a purely remote unauthenticated attack against an otherwise secure network path.
• No widespread in-the-wild exploitation confirmed as of this advisory’s publication.
• Not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog at the time of writing.

Recommendations

1. Immediate Action: Upgrade the MongoDB Node.js Driver to version 7.8.0 or later in all applications that use the driver.
2. Audit package.json and lockfiles for direct or transitive dependencies on the mongodb package and force resolution to a fixed version where needed.
3. Redeploy applications after the dependency update so the patched driver is loaded in production.
4. Inventory applications that use mongodb+srv:// connection strings (especially those connecting to MongoDB Atlas or other SRV-based clusters) and prioritize them for upgrade.
5. Review DNS resolver configuration and trust boundaries. Ensure that applications resolve SRV records through trusted, integrity-protected DNS paths where possible.
6. As a temporary measure where immediate upgrade is not feasible, consider switching critical connections from mongodb+srv:// to explicit mongodb:// host lists (understanding the operational trade-offs of doing so).
7. If unusual database connectivity, unexpected hosts, or credential-related anomalies are observed, treat the environment as potentially compromised: rotate database credentials, review access logs, and perform an integrity review.

Given the widespread use of the MongoDB Node.js Driver with SRV-based connection strings in modern Node.js applications, organizations should treat this as a high-priority dependency update, particularly for internet-facing or multi-tenant services.

Karen IT
We make the Internet harder to abuse.