The MongoDB Go Driver Team is pleased to release version 2.9.2 of the official MongoDB Go Driver.
Release Highlights
Warning
Go Driver versions v2.1.0 through v2.8.1 and v2.9.0 through v2.9.1 are affected by a security issue CVE-2026-81521 in Client.BulkWrite. The fix shipped in v2.8.2 but was not included in v2.9.0 or v2.9.1. This release restores the fix for the 2.9 line. Users on v2.9.0 or v2.9.1 are encouraged to upgrade to Go Driver v2.9.2 as soon as possible. Go Driver v1 is not affected.
This release addresses CVE-2026-81521, a security issue in calling Client.BulkWrite. A caller-controlled database name containing a period ('.') may be interpreted as a different namespace when forwarded to MongoDB. This could redirect operations to a database or collection other than the one intended by the application.
It also restores a fix from v2.8.1 that was likewise missing from v2.9.0 and v2.9.1: when a command's first attempt failed with a server error and the retry reported NoWritesPerformed, operations such as Database.RunCommand could return a nil error instead of the server error. They now return the original server error.
Sessions now inherit timeoutMS from the client, so operations run in a session honor the client-level timeout.
What's Changed
🐛 Fixed
- GODRIVER-4142: Inherit timeoutMS at the session level (#2586) by @prestonvasquez in #2598
- GODRIVER-4135 Reject negative uncompressed size in DecompressPayload. by @qingyang-hu in #2607
- GODRIVER-4083 fix duplicate error logging for network error by @ayesha-ilm in #2595
- GODRIVER-4136: reject BSON lengths below the 5-byte minimum before slicing by @rajath201 in #2591
- GODRIVER-4118 fix: correct Truncate boundary handling for multi-byte UTF-8 characters by @zigzagdev in #2564
- GODRIVER-4177 guard empty documents slice in decodeOpReply QueryFailure branch by @rajath201 in #2638
- GODRIVER-4075 Return an error if there are invalid characters in the … by @prestonvasquez in #2665
- GODRIVER-4088 Return the server error when the first attempt fails wi… by @prestonvasquez in #2666
Full Changelog: v2.9.1...v2.9.2