A flaw in MongoDB mongos, the sharded cluster router, allows an authenticated user with readWrite privileges to crash the process by submitting a specially crafted aggregation pipeline. The vulnerability arises from an internal aggregation stage that does not perform the expected authorization checks, letting a downstream stage be forced to execute under conditions for which it was not designed. This results in an unhandled fatal error that terminates mongos, causing a denial of service for all clients routed through the affected instance.

MongoDB Server is affected; all current versions may be vulnerable until a patch has been applied. No specific version range is disclosed in the CNA data.

The CVSS score of 7.1 indicates a high severity denial‑of‑service risk. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated account with readWrite privileges that can submit an aggregation request. The attack can be carried out without privilege escalation by targeting the router directly, but it depends on access to the mongos service. Once triggered, the mongos process aborts, immediately disrupting any applications that rely on it for routing client requests. The impact is contained to the affected router, but it can cascade to all services that depend on it if no failover or redundancy is in place.