CVE-2026-96748

The record

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of their choosing to be added to the application's database client. The application may then send its authentication exchange and database operations to one of those servers, which can observe limited information and return altered results.

Affected packages

Related vulnerabilities

• CVE-2026-76172 fast-uri is a URI parser for Node.js. CWE-177
• CVE-2026-41041 URL path injection via unencoded user-supplied identifiers vulnerability in Apache… CWE-177
• GHSA-x428-ghpx-8j92 @fastify/static vulnerable to route guard bypass via encoded path separators CWE-177
• CVE-2026-6414 @fastify/static versions 8.0.0 through 9.1.0 decode percent-encoded path separators (%2F)… CWE-177
• CVE-2026-29045 Hono is a Web application framework that provides support for any JavaScript runtime. CWE-177
• GHSA-q5qw-h33p-qvwr Hono vulnerable to arbitrary file access via serveStatic vulnerability CWE-177
• GHSA-g6q3-96cp-5r5m @fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding) CWE-177
• GHSA-cxrg-g7r8-w69p Fastify Middie Middleware Path Bypass CWE-177