The flaw resides in the connection management of the MongoDB Node.js driver. When an operation times out, the driver may leave a network connection in the pool while earlier data remains unconsumed. In applications that enable a client‑side timeout, an unauthenticated user that can send ordinary requests can force database replies to be paired with the wrong requests. This can cause unintended disclosure of other users’ records, incorrect operation results, and failures of legitimate requests.

MongoDB:Node.js Driver. Specific product versions are not disclosed in the advisory, so all releases of the driver that could contain the flaw should be examined until an update is available.

The CVSS score of 8.3 indicates a high severity. No EPSS score is provided, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote unauthenticated attacker sending normal requests to the application; the attacker does not need elevated privileges or code execution on the server. Because the flaw affects data handling within the driver, the impact can be significant for any application that relies on client‑side timeouts and does not otherwise enforce strict authentication for data‑access endpoints.