After invoking an internal JavaScript helper or a mapreduce map function in a specific way, an attacker who has authenticated access can crash the MongoDB server. The flaw is a post‑authentication use‑after‑free that terminates mongod, thereby denying service. This disrupts availability and can force an outage of the database service for all users. The vulnerability originates from improper memory handling in the server‑side JavaScript engine, as classified by CWE‑416.

MongoDB Server, versions 7.0 before 7.0.34, 8.0 before 8.0.23, 8.2 before 8.2.9, and 8.3 before 8.3.2 are vulnerable.

The CVSS score of 7.7 marks this issue as high severity. No EPSS data is available and the vulnerability is not yet in the CISA KEV catalog. Because the flaw requires authenticated access, the attack vector is typically a locally authenticated or remotely authenticated threat, depending on how the database is exposed. An attacker can trigger the crash by crafting commands that use $where, $function, or the mapreduce reduce stage, leading to a denial of service for all users.