Re-release 4.4, 5.0, and 6.0?

MongoDB has, once again, published fixes for end-of-life software. Should we re-add them for CVE-2026-11933?

A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated user with read privileges who is able to run server-side JavaScript (for example, via $where or $function) can cause the server to access memory that has already been freed. This may result in disclosure of information from the mongod process memory or a denial of service through a server crash.

4.4.31, 5.0.34, and 6.0.29 have all been released that address this bug.

(Currently active versions are already updated: https://github.com/docker-library/mongo/commit/b05f3db94d7c2ff82c00c93bc349c0e0e8107569, https://github.com/docker-library/mongo/commit/962851fd9c12d66f75837dd2844c83369d4ed364, https://github.com/docker-library/mongo/commit/a8cac75a3a6fedc2ce048069a862a9bcb07cd69f, https://github.com/docker-library/mongo/commit/2c69a57b939afb99266e8f97258adb178e9559e0)

Review the earlier re-release discussions in pull requests 744 and 756, then compare the fixes in MongoDB 4.4.31, 5.0.34, and 6.0.29 with the current-version updates linked in the issue. Done means reaching and documenting a decision on whether the end-of-life versions should be re-added for CVE-2026-11933.