MongoDB 8.3.8

Breaking: MongoDB 8.3.8 ships today. Security and reliability patch release, published August 11, 2026.

This is the kind of release you install before reading the notes.

Security Fixes

• 26 CVEs addressed — CVE-2026-18687 through CVE-2026-18712
• Intra-cluster SASL mechanism allowlist now enforced on egress connections
• authenticationMechanisms enforced on the MONGODB-X509 path
• Internal user required for commitTransaction/abortTransaction on prepared transactions
• slowms and sampleRate in the profile command now require higher authorization
• User-provided $$vectorSearch arguments can no longer override internal options

Reliability Fixes

• Heap use-after-free fixed in collection validation for large polygons
• Bucket OID collision during bucket allocation — dangling pointer resolved
• Malformed FlatBSON store from duplicate field names — fixed
• Duplicate inserts into clustered collections with Decimal128 _id — fixed
• $$documents disallowed with $$_resumeAfter/$$_startAt
• $$unwind initialization order fixed in $$graphLookup
• FLE2 compaction no longer inserts excessive range padding into the ESC
• Text search: $$text and $$near prohibited in $$_internalSchemaCond

Why It Matters

Every fix in 8.3.8 targets either a CVE or a crash-class bug. Upgrade path is standard — single-version adjacent upgrades only.

Patch now. Test after.