CVE-2026-81525: mongodb: Reject "." and NUL bytes in database and collection names
Passing untrusted input as part of a database or collection name may result in targeting a different database or collection than specified.
References
- github.com/advisories/GHSA-65fr-j4p9-vc33
- github.com/mongodb/mongo-php-driver/releases/tag/1.21.6
- github.com/mongodb/mongo-php-driver/releases/tag/1.21.7
- github.com/mongodb/mongo-php-driver/releases/tag/2.4.1
- github.com/mongodb/mongo-php-library/commit/3a462213bb4fd46efa58a1937b06b1b0553b67a7
- github.com/mongodb/mongo-php-library/commit/6f305a3b21740080255a3093b12458274c7cc8ca
- github.com/mongodb/mongo-php-library/pull/1967
- github.com/mongodb/mongo-php-library/pull/1968
- github.com/mongodb/mongo-php-library/releases/tag/1.21.4
- github.com/mongodb/mongo-php-library/releases/tag/2.4.1
- github.com/mongodb/mongo-php-library/security/advisories/GHSA-65fr-j4p9-vc33
- jira.mongodb.org/browse/PHPLIB-1927
- nvd.nist.gov/vuln/detail/CVE-2026-81525
Code Behaviors & Features
Detect and mitigate CVE-2026-81525 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →