MongoDB 8.0 lifecycle

At a glance

Version line

8.0

Initial release

2 Oct 2024

Lifecycle phase

standard support

Latest stable

8.0.29

Latest release date

11 Aug 2026

EOL

31 Oct 2029

Until EOL

~38 months

Risk

low

Releases tracked

27

1. Release

   2 Oct 2024

2. standard supportcurrent

   2 Oct 2024 → 31 Oct 2029

   Source: MongoDB Server lifecycle schedule

3. end of life

   31 Oct 2029 → —

   Source: MongoDB Server lifecycle schedule

MongoDB 8.0 is currently in standard support.

Known vulnerabilities

15

Known exploited

0

Highest CVSS

—

• CVE-2026-13073

  MongoDB Aggregation Command Invariant Assertion Failure Leading to Process Termination

  Affected:

  >=8.0.0,<8.0.28

  Fixed in:

  8.0.28

  Source:

  OSV source · Advisory

• CVE-2026-9743

  Aggregation sub-pipeline null dereference may allow DoS via crafted getMore

  Affected:

  >=8.0.0,<8.0.24

  Fixed in:

  8.0.24

  Source:

  OSV source · Advisory

• CVE-2026-25610

  Invalid $geoNear index hint may cause server crash

  Affected:

  >=8.0.0,<8.0.13

  Fixed in:

  8.0.13

  Source:

  OSV source · Advisory

• CVE-2025-12657

  Malformed KMIP response may result in access violation

  Affected:

  >=8.0.0,<8.0.10

  Fixed in:

  8.0.10

  Source:

  OSV source · Advisory

• CVE-2025-11979

  Use-after-free in the MongoDB server query planner may lead to crash or undefined behavior

  Affected:

  >=8.0.0,<8.0.15

  Fixed in:

  8.0.15

  Source:

  OSV source · Advisory

• CVE-2025-10060

  MongoDB may be susceptible to Invariant Failure in Transactions due Upsert Operation

  Affected:

  >=8.0.0,<8.0.12

  Fixed in:

  8.0.12

  Source:

  OSV source · Advisory

• CVE-2025-10059

  MongoDB Server router will crash when incorrect lsid is set on a sharded query

  Affected:

  >=8.0.0,<8.0.6

  Fixed in:

  8.0.6

  Source:

  OSV source · Advisory

• CVE-2025-6714

  Incorrect Handling of incomplete data may prevent mongoS from Accepting New Connections

  Affected:

  >=8.0.0,<8.0.9

  Fixed in:

  8.0.9

  Source:

  OSV source · Advisory

• CVE-2025-6713

  MongoDB Server may be susceptible to privilege escalation due to $mergeCursors stage

  Affected:

  >=8.0.0,<8.0.7

  Fixed in:

  8.0.7

  Source:

  OSV source · Advisory

• CVE-2025-6712

  MongoDB Server may be susceptible to DoS due to Accumulated Memory Allocation

  Affected:

  >=8.0.0,<8.0.10

  Fixed in:

  8.0.10

  Source:

  OSV source · Advisory

• CVE-2025-6711

  Incomplete Redaction of Sensitive Information in MongoDB Server Logs

  Affected:

  >=8.0.0,<8.0.5

  Fixed in:

  8.0.5

  Source:

  OSV source · Advisory

• CVE-2025-6710

  Pre-authentication Denial of Service Stack Overflow Vulnerability in JSON Parsing via Excessive Recursion in MongoDB

  Affected:

  >=8.0.0,<8.0.5

  Fixed in:

  8.0.5

  Source:

  OSV source · Advisory

• CVE-2025-6709

  Pre-Authentication Denial of Service Vulnerability in MongoDB Server's OIDC Authentication

  Affected:

  >=8.0.0,<8.0.5

  Fixed in:

  8.0.5

  Source:

  OSV source · Advisory

• CVE-2025-6707

  Race condition in privilege cache invalidation cycle

  Affected:

  >=8.0.0,<8.0.5

  Fixed in:

  8.0.5

  Source:

  OSV source · Advisory

• CVE-2025-6706

  Running certain aggregation operations with the SBE engine may lead to unexpected behavior on MongoDB Server

  Affected:

  >=8.0.0,<8.0.4

  Fixed in:

  8.0.4

  Source:

  OSV source · Advisory

Total releases

27

Last 30 days

1

Last 90 days

5

Avg. interval

~27 days

Most recent

11 Aug 2026

Releases tracked

27

Lifecycle periods

2

EOL

Known

Provenance records

3

Data last checked

1 Sept 2026

Latest source update

1 Sept 2026

• Previous

  MongoDB 7.0

  standard support · EOL 31 Aug 2027

• Next

  MongoDB 8.2

  end of life · EOL 31 Jul 2026