Vulnerability Reportmongo:9.0.4

This image is acceptable for production, but remediating the identified vulnerabilities is recommended to reduce the attack surface. The main concern is CVE-2026-86145, a memory-corruption flaw in the pcre2 regex library that mongod uses by default to process client queries, so a crafted regex from a network client could possibly lead to code execution on the server. The image also contains 54 exposed-surface findings in total, and none are known to be actively exploited, but they still widen the attack surface and should be tracked. The 16 post-exploit-only findings are low severity and do not change this assessment. Because the container runs as root by default, updating the pcre2 package and running the container with least privilege would reduce the impact of any future exploit.