Limit parsing in cluster geoNear calls BSONElement::numberInt()here. This can result in undefined behavior, since all that is known about the BSONElement is that it is a number. Instead we should call BSONElement::safeNumberLong(), like in geoNear limit parsing in mongod here.