medium6.5
CVE-2026-82052
The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server (mongod).
Impact
The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server (mongod). Under certain specific conditions the regex match can start in the middle of a multi-code-unit character, triggering an assertion during query execution.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mongodb | Mongodb | from 7.0.0 before 7.0.41 from 8.0.0 before 8.0.30 from 8.3.0 before 8.3.9 |