- Package
- mongodb/mongodb
- Fixed in
- 1.21.4, 2.4.1
- Published
- Tue 8 Sep 2026, 22:27 LisbonUpdated Sun 25 Oct 2026, 22:25 Lisbon
- Installs on Packagist
- 74M
In plain words
If untrusted input is used as part of a database or collection name, an attacker may cause the library to target a different database or collection than intended. This affects applications that pass such input to the affected versions of mongodb/mongodb.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| mongodb/mongodb | < 1.21.4 | 1.21.4 |
| mongodb/mongodb | >= 2.0.0, < 2.4.1 | 2.4.1 |
Am I affected?
Check the mongodb/mongodb entry in composer.lock. Affected versions are below 1.21.4, or at least 2.0.0 but below 2.4.1. If your version is affected, check whether your code passes untrusted input as part of database or collection names to the library's APIs. Fixed versions are 1.21.4 and 2.4.1.
What to do
Check which version you have, then update to a fixed release for your branch (1.21.4, 2.4.1):
composer show mongodb/mongodb | grep versions
composer update mongodb/mongodbIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
If you cannot update yet
Validate database and collection names before passing them into APIs.
The advisory's description
Impact
Passing untrusted input as part of a database or collection name may result in targeting a different database or collection than specified.
Patches
Fixed in PHP library 1.21.4 and 2.4.1.
Workarounds
Validate database and collection names prior to passing into APIs.
Weakness: CWE-943 Improper Neutralization of Special Elements in Data Query Logic.
The advisory
- GitHub Advisory Database: GHSA-65fr-j4p9-vc33, with who is affected and how
- OSV.dev: GHSA-65fr-j4p9-vc33
- The week's digest, with the other advisories from 7 Sep 2026
- All advisories for mongodb/mongodb