Important
This release addresses two CVEs in how the driver decides which types may be created from type discriminators in the database. The driver is now stricter in two ways: it detects compiler-generated anonymous types more precisely, and when allowed types are defined by assembly it also checks generic arguments and array element types. Both changes can cause deserialization that previously succeeded to throw until the types involved are explicitly allowed, so review the notes below before upgrading.
This release also removes the prefixPreview, suffixPreview and substringPreview APIs, which is an unrelated breaking change.
This is the general availability release for the 3.14.0 version of the driver.
Security fixes:
- CSHARP-6160 / CVE-2026-126982: Types specified by a type discriminator are now checked recursively when the allowed types are defined by assembly
- Behavior change: When deserializing a type specified by a type discriminator using
ObjectSerializerAllowedTypesConvention(params Assembly[]), generic type arguments and array element types are now checked as well as the generic definition. Types that were previously allowed only because their generic definition was in an allowed assembly might now throw until their type arguments are also allowed.
- Behavior change: When deserializing a type specified by a type discriminator using
- CSHARP-6169 / CVE-2026-126839: Anonymous type detection is now more rigorous
- Behavior change: When deserializing types, a type is now treated as a compiler-generated anonymous type only if it matches the compiler's naming pattern, is compiler-generated, and has only fields and properties typed by its generic parameters. Types that are not anonymous types but resemble them might now throw on deserialization until they are explicitly allowed.
Breaking changes:
- CSHARP-6137: Drop prefixPreview, suffixPreview, and substringPreview APIs
Fixes:
- CSHARP-6181: Reject @<current> and @<elem> filter field names that collide with path markers
Maintenance:
- CSHARP-6266: Update libmongocrypt to 1.21.1
The full list of issues resolved in this release is available at CSHARP JIRA project.
Documentation on the .NET driver can be found here.