Important
This is a security patch release. It addresses a number of CVEs reported against the driver and does not include any functional changes or API modifications. Upgrading is recommended for all users; no code changes are required on the application side.
This is a patch release that contains fixes and stability improvements:
- CSHARP-6164 / CVE-2026-81530: KMS master key exposure via unredacted credential serialization in driver settings string
- CSHARP-6171 / CVE-2026-81529: Connection-option injection via unescaped settings in the canonical MongoDB URL builder
- CSHARP-6158 / CVE-2026-81528: NoSQL injection via array replacement bypassing update shape validation in driver write path
- CSHARP-6156 / CVE-2026-81527: NoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translation
- CSHARP-6178 / CVE-2026-81527: NoSQL injection via equality-filter simplification of dollar-keyed documents in the LINQ provider
- CSHARP-6185 / CVE-2026-81527: NoSQL injection via unescaped dollar-prefixed values in LINQ constant arrays and documents
The full list of issues resolved in this release is available at CSHARP JIRA project.
Documentation on the .NET driver can be found here.