HIGH8.1
GHSA-65fr-j4p9-vc33
mongodb: Reject "." and NUL bytes in database and collection names
Quick fix
GHSA-65fr-j4p9-vc33 — mongodb/mongodb: upgrade to the fixed version with the command below.
composer require mongodb/mongodb:^1.21.4Details
### Impact Passing untrusted input as part of a database or collection name may result in targeting a different database or collection than specified.
### Patches Fixed in PHP library 1.21.4 and 2.4.1.
### Workarounds Validate database and collection names prior to passing into APIs.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist/mongodb/mongodb
Introduced in:
0Fixed in: 1.21.4Fix
composer require mongodb/mongodb:^1.21.4Packagist/mongodb/mongodb
Introduced in:
2.0.0Fixed in: 2.4.1Fix
composer require mongodb/mongodb:^2.4.1References
- https://github.com/mongodb/mongo-php-library/security/advisories/GHSA-65fr-j4p9-vc33[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2026-81525[ADVISORY]
- https://github.com/mongodb/mongo-php-library/pull/1967[WEB]
- https://github.com/mongodb/mongo-php-library/pull/1968[WEB]
- https://github.com/mongodb/mongo-php-library/commit/3a462213bb4fd46efa58a1937b06b1b0553b67a7[WEB]
- https://github.com/mongodb/mongo-php-library/commit/6f305a3b21740080255a3093b12458274c7cc8ca[WEB]
- https://github.com/mongodb/mongo-php-driver/releases/tag/1.21.6[WEB]
- https://github.com/mongodb/mongo-php-driver/releases/tag/1.21.7[WEB]
- https://github.com/mongodb/mongo-php-driver/releases/tag/2.4.1[WEB]
- https://github.com/mongodb/mongo-php-library[PACKAGE]
- https://github.com/mongodb/mongo-php-library/releases/tag/1.21.4[WEB]
- https://github.com/mongodb/mongo-php-library/releases/tag/2.4.1[WEB]
- https://jira.mongodb.org/browse/PHPLIB-1927[WEB]