high · 8.1CVE-2026-81525Sep 8, 2026

CVE-2026-81525: mongodb/mongodb PHP Library NoSQL Namespace Injection via Dot and NUL Bytes

Shubham Kandhare
Security Engagement Manager, SecureLayer7

Untrusted input containing a dot or a NUL byte in a MongoDB database or collection name can silently redirect queries to a completely different database or collection, bypassing access controls in…

Packagemongodb/mongodb
Ecosystemcomposer
Affected< 1.21.4
Fixed in1.21.4
CVE-2026-81525: mongodb/mongodb PHP Library NoSQL Namespace Injection via Dot and NUL Bytes

The problem

The MongoDB PHP Library (composer package mongodb/mongodb) built namespace strings by joining the database name and collection name with a dot: db + "." + collection. The server then splits that string at the first dot to recover the two components.

If an attacker-controlled string containing a dot is accepted as the database name, the server sees a different database than the one the application intended. A NUL byte (\x00) causes C-string and wire-protocol truncation, silently dropping everything after it.

Both inputs could target arbitrary namespaces without triggering any exception.

Proof of concept

A working proof-of-concept for CVE-2026-81525 in mongodb/mongodb, with the exact payload below.

php
<?php
// Dot in database name: targets collection "orders" in db "admin"
// instead of the intended db "tenant_abc.orders"
$db = $client->selectDatabase("admin.tenant_abc");
$col = $db->selectCollection("orders");
$col->find([]);  // server splits at first dot -> db=admin, col=tenant_abc.orders

// NUL byte in collection name: truncates to "users" on the wire
// anything after \x00 is silently dropped
$col2 = $db->selectCollection("users\x00.hidden_audit_log");
$col2->find([]);  // server receives collection name "users" only
?>

The root cause is CWE-943 (Improper Neutralization of Special Elements in Data Query Logic). The library forwarded raw, unvalidated strings directly to the underlying C driver, which assembled the BSON namespace. Because the server splits the namespace string at the first ., inserting a dot in the database name component lets an attacker pick any target database.

A NUL byte is treated as the end of a C string by both the driver and the wire protocol's cstring encoding, so everything after it is silently discarded, allowing a second truncation-based namespace redirect.

The patch (PRs #1967 and #1968, commits 3a46221 and 6f305a3) added explicit validation at the PHP library layer: dots are now rejected in database names and NUL bytes are rejected in both database and collection names, throwing an InvalidArgumentException before any network call is made.

The fix

Upgrade to mongodb/mongodb version **1.21.4** (v1.x branch) or **2.4.1** (v2.x branch). As a short-term workaround, validate and reject any database or collection name that contains a . or a NUL byte (\x00) before passing it to library APIs.

Reported by MongoDB Security Team (reported internally; patch by @GromNaN).

References: [1][2][3][4][5][6]

Related research