Should a database like MongoDB answer on the internet?

What does an open database port mean?

MongoDB binaries, mongod and mongos , bind to localhost by default.

Databases hold the records behind your website, client portal or practice software. MongoDB listens on port 27017; MySQL, PostgreSQL and Redis have their own ports.

MongoDB's own documentation says its server programs bind to localhost by default. A database that answers from outside has had that setting changed.

Why does it matter?

MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability 2025-12-29 MongoDB Server contains an improper handling of length parameter inconsistency vulnerability in Zlib compressed protocol headers. This vulnerability may allow a read of uninitialized heap memory by an unauthenticated client.

On 29 December 2025 CISA added a MongoDB Server flaw to its catalog of exploited flaws. CISA says it may let a client with no account read memory it should not see.

The database itself is where client records sit, so there is nothing behind it left to protect.

What do I do about it?

Review policy/procedure changes, especially changes to your network rules to prevent inadvertent MongoDB exposure to the Internet.

MongoDB's checklist says to review network rule changes so the database is not exposed to the internet by accident.

1. Set the database to listen only on localhost or your private network.
2. Block its port in your firewall or cloud security group.
3. Turn on authentication and use strong, unique passwords.
4. Update the database server to a fixed version.