CVE-2026-31827
Received Received - Intake
MongoDB TTL Index Misuse in Alienbin Causes Data Loss

Publication date: 2026-03-10

Last updated on: 2026-03-10

Assigner: GitHub, Inc.

Description
Alienbin is an anonymous code and text sharing web service. In 1.0.0 and earlier, the /save endpoint in server.js drops and recreates the MongoDB TTL index on the entire post collection for every new paste submission. When User B submits a paste with a short TTL (e.g., 30 seconds), the TTL index is recreated with expireAfterSeconds: 30 for all documents in the collection. This causes User A's paste (originally set to 7 days) to be deleted after 30 seconds. An attacker can intentionally delete all existing pastes by repeatedly submitting pastes with ttlOption=30s.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-10
Last Modified
2026-03-10
Generated
2026-06-19
AI Q&A
2026-03-11
EPSS Evaluated
2026-06-18
NVD
CVE-2026-31827
EUVD
EUVD-2026-10926
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
alienbin alienbin to 1.0.0 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-362 The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in Alienbin, an anonymous code and text sharing web service, version 1.0.0 and earlier. The issue is in the /save endpoint of the server.js file, which drops and recreates the MongoDB TTL index on the entire post collection every time a new paste is submitted.

When a user submits a paste with a very short TTL (time-to-live), for example 30 seconds, the TTL index is recreated with that short expiration time for all documents in the collection. This causes all other pastes, even those originally set to expire after a longer period (like 7 days), to be deleted after the short TTL.

An attacker can exploit this by repeatedly submitting pastes with a short TTL, effectively deleting all existing pastes prematurely.

Impact Analysis

This vulnerability can lead to unintended deletion of data. Specifically, legitimate pastes that users expect to persist for a certain duration can be deleted much earlier than intended.

An attacker can exploit this flaw to delete all existing pastes by submitting multiple pastes with very short TTLs, causing data loss and potential disruption of service.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-31827. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart