---
id: CVE-2026-81525
aliases:
  - GHSA-65fr-j4p9-vc33
title: 'mongodb: Reject "." and NUL bytes in database and collection names'
summary: 'mongodb: Reject "." and NUL bytes in database and collection names'
severity: high
cvss: 8.1
cwe:
  - CWE-943
vendor: mongodb
product: mongodb/mongodb
ecosystem: composer
affected:
  - mongodb/mongodb < 1.21.4
  - 'mongodb/mongodb >= 2.0.0, < 2.4.1'
patched:
  - mongodb/mongodb 1.21.4
  - mongodb/mongodb 2.4.1
published: '2026-09-08'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T21:27:45Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-65fr-j4p9-vc33'
references:
  - url: >-
      https://github.com/mongodb/mongo-php-library/security/advisories/GHSA-65fr-j4p9-vc33
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-81525'
  - url: 'https://github.com/mongodb/mongo-php-library/pull/1967'
  - url: 'https://github.com/mongodb/mongo-php-library/pull/1968'
  - url: >-
      https://github.com/mongodb/mongo-php-library/commit/3a462213bb4fd46efa58a1937b06b1b0553b67a7
  - url: >-
      https://github.com/mongodb/mongo-php-library/commit/6f305a3b21740080255a3093b12458274c7cc8ca
  - url: 'https://github.com/mongodb/mongo-php-driver/releases/tag/1.21.6'
  - url: 'https://github.com/mongodb/mongo-php-driver/releases/tag/1.21.7'
  - url: 'https://github.com/mongodb/mongo-php-driver/releases/tag/2.4.1'
  - url: 'https://github.com/mongodb/mongo-php-library/releases/tag/1.21.4'
  - url: 'https://github.com/mongodb/mongo-php-library/releases/tag/2.4.1'
  - url: 'https://jira.mongodb.org/browse/PHPLIB-1927'
  - url: 'https://github.com/advisories/GHSA-65fr-j4p9-vc33'
tags:
  - ghsa
  - composer
epss: 0.00478
epssPercentile: 0.38649
ingestedAt: '2026-09-08T22:12:30.968Z'
---

## Overview

### Impact
Passing untrusted input as part of a database or collection name may result in targeting a different database or collection than specified.

### Patches
Fixed in PHP library 1.21.4 and 2.4.1.

### Workarounds
Validate database and collection names prior to passing into APIs.

## Affected packages

- `mongodb/mongodb < 1.21.4`
- `mongodb/mongodb >= 2.0.0, < 2.4.1`

## Remediation

Upgrade to a patched release:

- `mongodb/mongodb 1.21.4`
- `mongodb/mongodb 2.4.1`