This vulnerability (CVE-2026-8336) is a use-after-free (CWE-416) issue in MongoDB Server affecting versions 8.2 before 8.2.9 and 8.3 before 8.3.2. It arises after invoking the internal $_internalJsEmit function or the mapreduce command's map function in unintended ways. An authenticated user can trigger a crash of the mongod process by subsequently using the server-side JavaScript engine features ($where, $function, mapreduce reduce stage) in a specific manner. This leads to a denial-of-service condition post-authentication. The CVSS 4.0 vector indicates network attack vector, high complexity, partial privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported, and no official patch or remediation guidance is currently documented.

The impact of this vulnerability is a post-authentication denial-of-service against MongoDB Server instances running affected versions. An authenticated attacker can cause the mongod process to crash, resulting in service disruption. There is no indication of remote code execution or data compromise from the provided data. The vulnerability affects confidentiality, integrity, and availability to a high degree according to the CVSS vector, but the primary confirmed impact is denial-of-service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided in the available data, users should monitor MongoDB, Inc. advisories for updates. Until a fix is available, restrict access to authenticated users and avoid using the affected server-side JavaScript features in ways that could trigger the vulnerability if possible.