MongoDB Server third-party support
MongoDB Server 8.2 (Rapid Release)
MongoDB Server 8.2 (Rapid Release)
The MongoDB Server 8.2 (Rapid Release) reached end of service life on Jul 31, 2026 — MongoDB Server no longer ships security patches or fixes for it. Our third-party support keeps it safe to run: 24/7 engineers manage issues, remediate vulnerabilities, and help you maintain compliance.
End of Service LifeEOSL Date: Jul 31, 2026
Issue Management
24/7 engineers own your MongoDB Server 8.2 (Rapid Release) incidents end to end.
Vulnerability Remediation
Mitigation and patch-around guidance when the vendor no longer ships fixes.
Compliance Maintenance
Controls evidence and documentation that keep auditors satisfied.
Specifications
- product
- mongodb
- release
- 8.2
- product Label
- MongoDB Server
- release Label
- 8.2 (Rapid Release)
- codename
- lts
- latest Version
- 8.2.12
- release Date
- 2025-09-30
- maintained
- source Url
- https://endoflife.date/mongodb
Lifecycle Dates
- End of Service Life
- Jul 31, 2026
- Last OEM Support
- Jul 31, 2026
OEM vs. 3rd Party Support
See how third-party support compares to the vendor contract for MongoDB Server 8.2 (Rapid Release) — monitoring, break/fix, vulnerability work, operations and compliance, before and after EOSL.
| Feature | OEM Support | 3rd Party Support |
|---|---|---|
| Post-EOSL Support | ||
| Break/Fix Support | Until EOSL | |
| 24/7 Monitoring | ||
| Vulnerability Scanning & Remediation | ||
| Managed Operations | ||
| Procedure & Configuration Review | ||
| Compliance & Audit Documentation | Limited | |
| Discounted Migration to Other Platforms |
Why Choose 3rd Party Support for MongoDB Server 8.2 (Rapid Release)?
Vulnerability Remediation
Scanning, mitigation and patch-around guidance for MongoDB Server 8.2 (Rapid Release) when the vendor no longer ships fixes.
Compliance Maintenance
Procedure review, controls evidence and the documentation auditors ask for — maintained continuously, not scrambled at audit time.
24/7 Expert Support
Engineers who know this release monitor, manage and fix issues around the clock — break/fix to managed operations.
MongoDB Server 8.2 (Rapid Release) Support: Frequently Asked Questions
Is the MongoDB Server 8.2 (Rapid Release) still supported?
MongoDB Server ended support for the MongoDB Server 8.2 (Rapid Release) on Jul 31, 2026 — no more patches or fixes from the vendor. Third-party support keeps it covered: our engineers manage issues, remediate vulnerabilities, and help you maintain compliance for as long as you run it.
When is the MongoDB Server 8.2 (Rapid Release) end of service life (EOSL) date?
MongoDB Server lists the end of service life for the MongoDB Server 8.2 (Rapid Release) as Jul 31, 2026.
Can I keep using the MongoDB Server 8.2 (Rapid Release) after its EOSL date?
Yes. EOSL means MongoDB Server stops issuing patches and support — the software itself keeps running. Third-party support covers it from there: issue management, security vulnerability remediation, and the compliance documentation auditors ask for, for as long as you choose to run it.
How much does third-party support for the MongoDB Server 8.2 (Rapid Release) cost?
Typically 40-70% below the OEM maintenance renewal price. Exact pricing depends on quantity, service level and location. You get an indicative price within 24 hours and a firm quote within 48.
Known Vulnerabilities Affecting MongoDB Server 8.2 (Rapid Release)
87 published CVEs affect the MongoDB Server 8.2 (Rapid Release), including 60 rated critical or high severity. MongoDB Server no longer ships security patches for this release — our engineers provide mitigation guidance, workarounds and hardening support.
| CVE | Severity | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-13072 | CRITICAL | 9.2 | Jul 22, 2026 | When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potentially leading to process termination or other unintended behavior. This configuration is non-default and requires explicit enablement at startup. |
| CVE-2026-18691 | CRITICAL | 9.0 | Aug 11, 2026 | An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used when one replica set member connects to another. Under certain conditions, this could cause the cluster's shared internal credential to be transmitted in a less-protected form, potentially allowing that credential to be recovered. If recovered, the credential could be used to authenticate as the internal superuser to nodes in the deploym |
| CVE-2026-18697 | HIGH | 8.7 | Aug 11, 2026 | An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service, disrupting client connections routed through the affected mongos instance. |
| CVE-2026-11933 | HIGH | 8.7 | Jun 12, 2026 | A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated user with read privileges who is able to run server-side JavaScript (for example, via $where or $function) can cause the server to access memory that has already been freed. This may result in disclosure of information from the mongod process memory or a denial of service through a server crash. |
| CVE-2026-9740 | HIGH | 8.7 | Jun 9, 2026 | A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod process by sending a specially crafted message. The BSON validator's handling of certain nested binary data structures permits uncontrolled mutual recursion between validation functions, where each re-entry resets internal depth tracking. |
| CVE-2026-8053 | HIGH | 8.7 | May 13, 2026 | An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds memory write in the mongod process. The issue results from an inconsistency in the internal field-name-to-index mapping within the time-series bucket catalog. Under certain conditions this can result in arbitrary code execution. This issue impacts MongoDB Server v5.0 versions prior to 5.0.33, v6.0 versions prior to 6.0.28, v7.0 versions prior |
| CVE-2026-4148 | HIGH | 8.7 | Mar 17, 2026 | A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who issues a specially crafted $lookup or $graphLookup aggregation pipeline. |
| CVE-2025-14847 | HIGH | 8.7 | Dec 19, 2025 | Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, Mong |
| CVE-2026-13059 | HIGH | 8.6 | Jul 22, 2026 | An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and aggregate commands in non-apiStrict configurations. |
| CVE-2026-9742 | HIGH | 8.2 | Jun 9, 2026 | When OIDC authentication is enabled in configuration, clients may set specific values in the "mechanism" parameter of the "authenticate" command that lead to server crash. The authenticate command is accessible to unauthenticated clients, leading to pre-auth denial-of-service in affected product configurations. |
| CVE-2026-1848 | HIGH | 8.2 | Feb 10, 2026 | Connections received from the proxy port may not count towards total accepted connections, resulting in server crashes if the total number of connections exceeds available resources. This only applies to connections accepted from the proxy port, pending the proxy protocol header. |
| CVE-2026-18692 | HIGH | 7.7 | Aug 11, 2026 | An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed. Subsequent operations could then result in a server crash or, potentially, execution of unintended code. |
| CVE-2026-8336 | HIGH | 7.7 | May 13, 2026 | After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subsequently crash mongod when the server-side JavaScript engine (through $where, $function, mapreduce reduce stage, etc.) is used also in a specific way, resulting in a post-authentication denial-of-service. This issue impacts MongoDB Server v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2. |
| CVE-2026-82053 | HIGH | 7.6 | Sep 8, 2026 | A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authentication under certain configurations. Subsequent authorization queries may execute under an unintended LDAP identity rather than the expected one. This can result in incorrect role assignments based on the LDAP directory's access control configuration, potentially allowing an authenticated user to acquire elevated privileges that were not |
| CVE-2026-18712 | HIGH | 7.2 | Aug 11, 2026 | An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain internal metadata references before they are used to perform operations on other namespaces. |
| CVE-2026-18693 | HIGH | 7.2 | Aug 11, 2026 | An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal data structure to become inconsistent through certain document insertions. A subsequent insert into the affected bucket could then result in the server accessing memory outside its intended bounds, potentially causing a server crash (denial of service), exposure of limited memory contents, or memory corruption. |
| CVE-2026-18690 | HIGH | 7.2 | Aug 11, 2026 | An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that their assigned privileges should not permit. This could result in critical system collections being dropped and recreated without proper authorization. |
| CVE-2026-9753 | HIGH | 7.2 | Jun 9, 2026 | The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bounds or crash the server. $_internalApplyOplogUpdate can be executed by any authenticated user with access to the aggregate command. |
| CVE-2026-82076 | HIGH | 7.1 | Sep 8, 2026 | An integer overflow in the query planning component of MongoDB Server can allow an authenticated user with ordinary database-level read/write privileges to bypass an internal resource limit. Submitting a specially crafted query causes the server to consume memory without bound during query planning, and the resulting exhaustion terminates the server process. This may result in a denial of service affecting all databases served by the affected node. |
| CVE-2026-82070 | HIGH | 7.1 | Sep 8, 2026 | A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected credentials from concurrent administrative operations. The same credentials are properly redacted in server log output, but the diagnostic interface omits equivalent redaction. Successful exploitation requires a valid authenticated session with monitoring-level permissions and results in exposure of cleartext credentials that could enable |
Showing the 20 most severe of 87 known CVEs.
Get Third Party SupportRelated MongoDB Server Products
All MongoDB Server products →MongoDB Server 8.2 (Rapid Release)
Price in 24 hours · 40-70% below OEM