GHSA-65fr-j4p9-vc33
mongodb: Reject "." and NUL bytes in database and collection names
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | mongodb/mongodb | < 1.21.4 | 1.21.4 |
| Packagist | mongodb/mongodb | >= 2.0.0, < 2.4.1 | 2.4.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Passing untrusted input as part of a database or collection name may result in targeting a different database or collection than specified.
### Patches
Fixed in PHP library 1.21.4 and 2.4.1.
### Workarounds
Validate database and collection names prior to passing into APIs.
References
External links from the advisory. They lead to third-party sites.
- https://github.com/mongodb/mongo-php-library/security/advisories/GHSA-65fr-j4p9-vc33
- https://nvd.nist.gov/vuln/detail/CVE-2026-81525
- https://github.com/mongodb/mongo-php-library/pull/1967
- https://github.com/mongodb/mongo-php-library/pull/1968
- https://github.com/mongodb/mongo-php-library/commit/3a462213bb4fd46efa58a1937b06b1b0553b67a7
- https://github.com/mongodb/mongo-php-library/commit/6f305a3b21740080255a3093b12458274c7cc8ca
- https://github.com/mongodb/mongo-php-driver/releases/tag/1.21.6
- https://github.com/mongodb/mongo-php-driver/releases/tag/1.21.7
- https://github.com/mongodb/mongo-php-driver/releases/tag/2.4.1
- https://github.com/mongodb/mongo-php-library
- https://github.com/mongodb/mongo-php-library/releases/tag/1.21.4
- https://github.com/mongodb/mongo-php-library/releases/tag/2.4.1
- https://jira.mongodb.org/browse/PHPLIB-1927