github mongodb/node-mongodb-native v7.8.0

5 hours ago

7.8.0 (2026-10-30)

The MongoDB Node.js team is pleased to announce version 7.8.0 of the mongodb package!

Release Notes

Warning

Node Driver versions from v6.11.0 and from v7.0.0 before v7.8.0 (this release) are affected by a security issue related to the use of the experimental timeoutMS feature where connection pool desynchronization after operation timeout can expose other users' data. Users are encouraged to discontinue the use of timeoutMS as soon as possible.

Warning

Node Driver versions from v3.3.3 before v7.8.0 (this release) are affected by a security issue concerning the verification of host names returned by SRV lookups, which could allow an attacker in control of the DNS response to redirect the driver to a host outside the user's domain. Users using SRV records are encouraged to upgrade to v7.8.0 as soon as possible.

timeoutMS is deprecated and now a no-op

Warning

timeoutMS and timeoutMode are deprecated and have no effect starting in this release. They are still accepted and will not throw, but operations will no longer time out because of them. They are slated for removal in a future release.

Use the per-stage timeouts instead: serverSelectionTimeoutMS, waitQueueTimeoutMS, socketTimeoutMS, and maxTimeMS for server-side execution.

Configurable SRV host validation

This release adds two new methods of validating DNS:

  1. srvAllowedHostsSuffix - A host name suffix that every host returned by the SRV lookup must end with. This option can be configured on the client or the connection string.
  2. srvHostValidator - A synchronous function that decides whether a host returned by the SRV lookup may be used. This option can only be configured on the client. This function must accept a string and has to return a boolean; returning anything else, including the Promise returned by an async function, will result in an error.

Warning

Modifying the default SRV domain name validation can create vulnerabilities.

SRV host names are now compared in a normalized form (case-insensitively, without a trailing dot, and with internationalized names in xn-- form). Connection strings whose SRV host name differs in case from the host names returned by DNS, such as mongodb+srv://TEST1.TEST.BUILD.10GEN.CC, previously failed SRV verification and now connect.

zstd compression no longer requires @mongodb-js/zstd on Node.js 22.15.0+

The driver now uses Node.js' built-in zstd implementation when it is available. On older Node.js versions it continues to use @mongodb-js/zstd, so no changes are needed for existing setups.

Thanks to @axelonet for the original contribution!

Distinguish between command-level options and index-level options when creating indexes

Before:

// Index options and command options were on the same object
await collection.createIndex(
  { email: 1 },
  {
    // index options
    unique: true,
    name: 'email_unique',
    // command options
    commitQuorum: 'majority',
    maxTimeMS: 5000
  }
);

After:

await collection.createIndex(
  { email: 1 },
  // Argument 2: options that describe the index itself
  { unique: true, name: 'email_unique' },
  // Argument 3: options for the createIndexes command
  { commitQuorum: 'majority', maxTimeMS: 5000 }
);

Both overloads will be supported for now. In a future major release, the two parameter overload will be removed.

Enjoy faster adoption of new index options

Before:

// The driver only forwarded options present in allow list.
// `newIndexOption` was silently dropped and never reached the server.
await collection.createIndex({ location: '2dsphere' }, { newIndexOption: true });

// But! `nonexistentIndexOption` was also removed and so the server never threw an error
await collection.createIndex({ location: '2dsphere' }, { nonexistentIndexOption: true });

After:

// Index options are passed to the server as written.
// This means you can use a new option supported by the server without waiting
// for the driver to add it to an allow list!
await collection.createIndex(
  { location: '2dsphere' },
  { newIndexOption: true },
  undefined
);

// But! it also means the driver will no longer prevent a bad option either
await collection.createIndex(
  { location: '2dsphere' },
  { nonexistentIndexOption: true }, // throws
  undefined
);

The two-parameter overload will continue to filter for valid index options. In a future major release, the two parameter overload will be removed.

Removed @experimental tags from features which are no-longer experimental

No-longer experimental entities:

  • DropCollectionOptions.encryptedFields
  • CreateCollectionOptions.encryptedFields
  • ClientEncryptionCreateDataKeyProviderOptions.keyMaterial
  • ClientEncryptionRewrapManyDataKeyProviderOptions
  • ClientEncryptionRewrapManyDataKeyResult

Alongside these changes is also a change to the return type of rewrapManyDataKey to ClientEncryptionRewrapManyDataKeyResult from an anonymous type. This improves internal type consistency and public api clarity without changing runtime behavior.

Sorting by $meta with a [field, direction] pair now works

Previously, passing a $meta sort direction in the [field, direction] form, for example cursor.sort(['score', { $meta: 'textScore' }]), threw MongoInvalidArgumentError: Invalid sort direction. The object form ({ score: { $meta: 'textScore' } }) and the nested array form ([['score', { $meta: 'textScore' }]]) already worked, so the same sort was accepted or rejected depending on how it was written. All three forms now behave the same.

Thanks to @spokodev for the fix!

Fix bulk write result insertedIds mismatches on bulkwrites with mixed op types

For unordered bulk writes that mixed inserts with updates or deletes, BulkWriteResult.insertedIds was keyed by a running count of inserts, not by each insert's index in the operations list. It's now keyed by the operation index, which matches ordered bulk writes and the documentation.

Thanks to @spokodev for this fix!

GridFS queries match file IDs exactly

GridFS download, delete, rename and upload abort now query by file ID with $eq. Nothing changes for normal IDs, but you'll see { _id: { $eq: <id> } } in command monitoring and logs.

hello commands are no longer compressed

When compressors was configured, the driver could send hello and isMaster on monitoring connections as compressed messages, which the compression specification forbids. These commands are now never compressed.

Features

Bug Fixes

Documentation

We invite you to try the mongodb library immediately, and report any issues to the NODE project.

Don't miss a new node-mongodb-native release

NewReleases is sending notifications on new releases.