MongoDB security advisory (AV26-911)

Serial Number: AV26-911
Date: September 11, 2026

As of September 10, 2026, MongoDB is affected by vulnerabilities in the following products:

• Java Driver
  • Prior to 5.11.1
• Laravel MongoDB (PHP)
  • Prior to 5.11.0

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• [PHPLARA-260] Query builder: force literal equality when 3-arg where uses '=' with an array value
• [JAVA-6276] Native heap use-after-free via cancellation racing KMS credential fetch in reactive encryption
• Alerts | MongoDB