MongoDB Server vulnerability

What happened

During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case. This may lead to incorrect transformations leading to invariant failure.

Affected versions

MongoDB Server: 7.0 through before 7.0.39 (semver); 8.0 through before 8.0.28 (semver); 8.2.0 through before 8.2.12 (semver); 8.3.0 through before 8.3.7 (semver) Fixed: See vendor advisory.

Why it matters

Review the vendor advisory and exposure of the affected product to determine operational impact.

Detection & mitigation

• Apply vendor-provided updates or mitigations.
• Review affected product exposure and access logs.