The MongoDB Shell (mongosh) relies on Node.js as a third-party runtime that carries its own TLS root certificate store.
The MongoDB Shell (mongosh) relies on Node.js as a third-party runtime that carries its own TLS root certificate store. This certificate store has the recoverable eMudhra intermediate CA certificates. This issue impacts MongoDB Shell (mongosh) versions prior to 2.14.0 and can be resolved by updating to mongosh 2.14.0 which bundles Node.js 24.22.1 or later. If mongosh is installed through npm, it uses the Node.js runtime installed on the host; update that runtime separately.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- MongoDB
- Product
- mongosh
- CVSS v3.1
- 6.8 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
- Weakness
- CWE-295
- Exposure class
- Identity, Developer platform, Database
- NVD status
- Received
Why it ranks 17 (Routine)
- CVSS v3.1 6.8 medium
- Exposed product class: identity
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.