What an awful vulnerability. The most interesting fact is that this has been there since the PR that introduced it in 2017[1].
I'm not sure how Mongo's review process works, but it seems like this one had zero review.
[1] - https://github.com/mongodb/mongo/pull/1152
In MongoBleedmongodb
mongo
C++2010–2025
mongodb / mongo
mongo
The MongoDB Database
33Distinct people
37Mentions
0Explicit recommenders
28.7KGitHub stars
What to know before exploring
What it is
The MongoDB Database
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 1:49:46 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year37 dated mentions
Observed mentions: 2010-06-06 02:03:43 UTC to 2025-12-28 12:37:44 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2010 | 2010-01-01 00:00:00 UTC | 2011-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2011 | 2011-01-01 00:00:00 UTC | 2012-01-01 00:00:00 UTC | 8 | 2 | 6 |
| 2012 | 2012-01-01 00:00:00 UTC | 2013-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2013 | 2013-01-01 00:00:00 UTC | 2014-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2014 | 2014-01-01 00:00:00 UTC | 2015-01-01 00:00:00 UTC | 4 | 0 | 4 |
| 2015 | 2015-01-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 2 | 1 | 1 |
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 3 | 0 | 3 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 3 | 0 | 3 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 6 | 0 | 6 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 3 | 0 | 3 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 3 | 1 | 2 |
From the project README
An excerpt from the repository, fetched Nov 13, 2026.
Read the project’s introduction
MongoDB README
Welcome to MongoDB!
Components
mongod - The database server.
mongos - Sharding router.
Download MongoDB
https://www.mongodb.com/try/download/community
Using homebrew brew tap mongodb/brew
Using docker image docker pull mongodb/mongodb-community-server
Download the MongoDB Shell
https://www.mongodb.com/try/download/shell
Using homebrew brew install mongosh
Building
See Building MongoDB.
Running
For command line options invoke:
$ ./mongod --help
To run a single server database:
$ sudo mkdir -p /data/db
$ ./mongod
$
$ # The mongosh shell connects to localhost and test database by default:
$ ./mongosh
test> help
Installing Compass
You can install compass using the install_compass script packaged with MongoDB:
$ ./install_compass
This will download the appropriate MongoDB Compass package for your platform and install it.
Drivers
Client drivers for most programming languages are available at
https://docs.mongodb.com/manual/applications/drivers/.
Bug Reports
See https://github.com/mongodb/mongo/wiki/Submit-Bug-Reports.
Packaging
Packages are created dynamically by the buildscripts/packager.py script.
This will generate RPM and Debian packages.
Learn MongoDB
Documentation - https://docs.mongodb.com/manual/
Developer Center - https://www.mongodb.com/developer/
MongoDB University - https://learn.mongodb.com
Cloud Hosted MongoDB
https://www.mongodb.com/cloud/atlas
Forums
https://mongodb.com/community/forums/
Technical questions about using MongoDB.
https://mongodb.com/community/forums/c/server-dev
Technical questions about building and developing MongoDB.
LICENSE
MongoDB is free and the source is available. Versions released prior to October 16, 2018 are
published under the AGPL. All versions released after October 16, 2018, including patch fixes for
prior versions, are published under the
Server Side Public License (SSPL) v1. See individual files for details
which will specify the license applicable to each file. Files subject to the SSPL will be noted in
their headers.
Read the full README on GitHubWhat Hacker News says
37 sourceshttps://github.com/mongodb/mongodb-kubernetes/blob/1.2.0/LIC... is crazypants, since it waffles back and forth between "Apache 2" and "commercial license terms." To say nothing of the fact that one is still responsible for the licensing of the resources managed by MCK itself; this is not a get-out-of-jail-free card for running Mongo which remains SSPL https://github.com/mongodb/mongo/blob/r8.0.12/LICENSE-Commun...
In MCK: Open-Source MongoDB OperatorAsk HN: Where is MongoDB source code?
There are no commits or tags for two months: https://github.com/mongodb/mongo/commits/master
In the meantime, 8.0.5 and 8.0.6 were released: https://www.mongodb.com/docs/manual/release-notes/8.0/
Those appear to be patch releases for major releases, not rapid releases, so the source should be available: https://www.mongodb.com/docs/manual/reference/versioning/
There is a forum post without an answer: https://www.mongodb.com/community/forums/t/source-code-in-github/316442
Is MongoDB no longer source-available?
12 points · Open discussionWrites in MongoDB are persisted before the server returns acknowledgement. For a typical replica set deployment, this additionally means replicated and made durable on disk for a majority of nodes.
MongoDB has tunable durability guarantees; clients can opt-out of this behavior.
The layers are deep, but this is the function that handles waiting before acknowledgement:
https://github.com/mongodb/mongo/blob/20f42d9dc89999d119f35a...
In Database FundamentalsIsn't mongodb open source?
https://github.com/mongodb/mongo
Edit: ah it's source-available, not open source.
In MongoDB’s new query engineWhat are you on about ?
https://github.com/elastic/elasticsearch
https://github.com/mongodb/mongo
How are ES and mongoDB not open source ?
Mongo switched from GPL v3 to SSPL in 2018 the only difference is whether you can offer mongoDB as a service , all other GPL clauses are the same , there is no difference for app developers I.e no vendor lock-in
Elastic moved from Apache 2 to ESL v2 for the same reasons with same restrictions against managed offerings again no restrictions for a app developer to host modify or do they want .
Redis splits between 3-BSD , SSPL and RSAL v2 and closed source for redis , Redis stack and Redis enterprise.
Just cause OSI does not consider restrictions on competing with the author Open source doesn’t make elastic or mongo less open source ( redis also uses these ) certainly not for anyone not a cloud vendor
In Unity’s new pricing: A wake-up call on the importance of open sourceSometimes it's pretty cut and dry, just people using open source without attribution and hoping that nobody will find out. But why?
MinIO is licensed under AGPL (the current versions, at least): https://github.com/minio/minio/blob/master/LICENSE
It effectively mandates that the modified version needs to be made available: https://en.wikipedia.org/wiki/GNU_Affero_General_Public_Lice...
The GNU Affero General Public License is a modified version of the ordinary GNU GPL version 3. It has one added requirement: if you run a modified program on a server and let other users communicate with it there, your server must also allow them to download the source code corresponding to the modified version running there.
So the logical first question is: why pick software that is using AGPL? Did the engineers/managers just not care? Did they miss it?
Read the rest
I know for a fact that there are many out there who couldn't care less about licenses and compliance. Maybe companies haven't been strong armed into caring about licensing as much as they have been in regards to GDPR, for example?
Secondly, why should the modified version remain a "secret"? Would competition suddenly spring up? Or maybe the project contains tight coupling to the rest of the platform, which could be considered a security risk?
Why isn't open sourcing a modified version something that would take a few hours anyways, since then none of this would be an issue?
(disclaimer: I discuss SSPL below because I find it interesting; apologies for the tangent)
Honestly, the state of software licensing sometimes puzzles me. For example, MongoDB switched over to SSPL altogether: https://www.mongodb.com/community/licensing
If you make the functionality of the Program or a modified version available to third parties as a service, you must make the Service Source Code available via network download to everyone at no charge, under the terms of this License. ...
Seems like that applies to even patches: https://github.com/mongodb/mongo
MongoDB is free and the source is available. Versions released prior to October 16, 2018 are published under the AGPL. All versions released after October 16, 2018, including patch fixes for prior versions, are published under the Server Side Public License (SSPL) v1. See individual files for details.
DigitalOcean, for example, proudly advertises managed MongoDB as a service: https://www.digitalocean.com/products/managed-databases-mong...
And yet, to the best of my understanding, the entirety of the DigitalOcean platform isn't open source (even though many projects are): https://github.com/orgs/digitalocean/repositories
Or even anything that might have something to do with MongoDB in particular: https://github.com/orgs/digitalocean/repositories?q=mongo&ty...
It just feels like one of those "rules for thee, not for me" situations, since it wouldn't be feasible for small companies to compete with them. Edit: someone mentioned them probably running the enterprise version which is probably the explanation for this!
That said, the thought experiment of building a company (including all systems) as 100% open source is really interesting, whether such a thing would be feasible if people stopped caring about "guarding" their IP and whatnot.
Minor correction, both of them are source available, but not open source
Cockroach DB license - https://github.com/cockroachdb/cockroach/blob/2c4e2c6/LICENS...
Mongo license - https://github.com/mongodb/mongo/blob/39e4b70/LICENSE-Commun...
In Neon – Serverless PostgresAlso for those curious here's the C++ query planner for Mongo: https://github.com/mongodb/mongo/blob/master/src/mongo/db/qu...
Checking whether the key pattern matches an index:
https://github.com/mongodb/mongo/blob/master/src/mongo/db/qu...
I wish Mongo could use intersecting indexes for queries and sorting...
In How Postgres chooses which index to use for a queryMongoDB | Software Engineer, Query | Full-time | $180-300k+ (total comp, negotiable) | NYC or Remote (North America only) | https://mongodb.com
MongoDB started as a NoSQL document database, but we are growing into a data platform with sophisticated support for transactional, analytics, full-text search, and time-series queries at huge scale.
This opening is specifically for my Database Query Optimization team, where you'll make core contributions to our flagship open source codebase (https://github.com/mongodb/mongo).
If you have relational or NoSQL Database expertise, that's great, but what's most important is that you have a track record of delivering robust implementations of complex algorithms in data-intensive production applications. The "SE3" level of this job requires 2+ years of experience and senior level requires 5+.
Our Stack:
Read the rest
Modern C++, Javascript, Linux
Apply at https://www.mongodb.com/careers/jobs/2204287. Please send your questions to steve.tarzia at mongodb.com. Direct candidates only (no recruiters, please).
And I understand that MongoDB are also testing with Antithesis [1] and getting lots of assurance from that, right?
That gives me confidence.
[1] https://github.com/mongodb/mongo/wiki/Testing-MongoDB-with-A...
In Cryptocurrency doesn’t address the hard parts of financial inclusionMongoDB | SE3/Senior Software Engineer, Query | Full-time | $180-300k+ (total comp, negotiable) | NYC, Chicago, or Remote (North America only) | https://mongodb.com
MongoDB started as a NoSQL document database, but we are growing into a data platform with sophisticated support for transactional, analytics, full-text search, and time-series queries at huge scale.
This opening is specifically for my Database Query Optimization team, where you'll make core contributions to our flagship open source codebase (https://github.com/mongodb/mongo).
If you have relational or NoSQL Database expertise, that's great, but what's most important is that you have a track record of delivering robust implementations of complex algorithms and experience with performance-sensitive, production codebases. The SE3 version of this job requires 2+ years of experie
Read the rest
nce and senior level requires 5+.
Our Stack: Modern C++, Javascript, Linux
Apply at https://www.mongodb.com/careers/jobs/2204287. Please send your questions to steve.tarzia at mongodb.com. Direct candidates only (no recruiters, please).
> Whatever makes you claim they want others to contribute?
1. They started out, and achieved their success partly, by making an Open Source database. When you publish something under that moniker, into the Open Source community, it is generally assumed you want to collaborate. That's the default. Projects that want to publish Open Source software but don't want collaboration (e.g., SQLite, AOSP, etc.) make it clear and explicit that they do not take contributions. Because collaboration is the default.
2. They set up contribution guidelines[1]. Their words: "MongoDB welcomes community contributions!".
3. They set up their own trackers and tools to classify issues/tickets for external contributions. Their words, again from [1]: "tickets of an appropriate complexity for new engineers are marked with a “neweng” label."
4. They evangelise Open
Read the rest
Source contributions. Even when they demand copyright assignment to accept any contribution.
1: https://github.com/mongodb/mongo/wiki
----
>> if I could modify the source code … But I can’t … legal.
> You absolutely can. Where did you get the idea that you cannot?
The SSPL is itself a copyright infringement, being an unlicensed and unauthorised modification of the AGPLv3. From the AGPLv3 license text: "Copyright © 2007 Free Software Foundation, Inc. <https://fsf.org/>
Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed." Hell, MongoDB Inc. even kept the same conditions in their unauthorised copy, while replacing the copyright claim of FSF with their own.
To distribute a modified version of MongoDB to a client, without breaking the conditions of the SSPL, I shall have to license my changes under the SSPL itself, and distribute a copy of the SSPL with it. I cannot legally convey a copy of the license text, even if MongoDB Inc. permits me to "copy and distribute verbatim copies" of the license document, when I know that they may not even have the copyrights to do so, and that the legal copyright holder of said document does not allow changes to it.
It's already implemented actually :') ! Trust me. I'm an engineer :D.
https://github.com/mongodb/mongo/blob/72ed8227aa029afd554aa5...
In Show HN: Monty, Mongo tinified. MongoDB implemented in Python> MongoDB switched to an open source model a decade ago
...and then moved back 2 years ago.
From the https://github.com/mongodb/mongo/blob/master/README :
>
MongoDB is free and the source is available.
Versions released prior to October 16, 2018 are published under the AGPL.
All versions released after October 16, 2018, including patch fixes for prior versions, are published
under the Server Side Public License (SSPL) v1.
AGPL is open source: https://opensource.org/licenses/AGPL-3.0
SSPLv1 is not listed, and SSPLv2 does not seem to have been approved either at last mention https://opensource.org/LicenseReview122018
In Internet 3.0 and the Beginning of (Tech) HistoryShowing the 15 most recent of 37 sources. Enable JavaScript to search and browse every indexed mention.