7.9.0 (2026-11-12)
The MongoDB Node.js team is pleased to announce version 7.9.0 of the mongodb package!
Release Notes
Warning
Node Driver versions from 6.7.0 before 7.9.0 (this release) are affected by a security issue related to OIDC bearer tokens being inappropriately shared to domains outside those allowlisted by the application (CVE-2026-126835). Users are encouraged to upgrade to the fixed version or mitigate as soon as possible.
Applications that use OIDC_CALLBACK or OIDC_HUMAN_CALLBACK in affected versions can avoid this bearer token leak by refusing connection strings whose authMechanismProperties include ENVIRONMENT.
MongoClient now throws when both ENVIRONMENT and OIDC_CALLBACK / OIDC_HUMAN_CALLBACK are passed to its constructor
When constructing a MongoClient:
ENVIRONMENTcan be specified in either the connection string or the options object provided to theMongoClientconstructor.OIDC_CALLBACKandOIDC_HUMAN_CALLBACKcan be specified only in the options object.
Now, providing an environment and a callback (in any combination of options and connection string) fails.
// Now fails:
// connection string:
// 'mongodb://example.com/?authMechanism=MONGODB-OIDC&authMechanismProperties=ENVIRONMENT:azure,TOKEN_RESOURCE:x'
const uri = process.env.MONGODB_URI;
// throws!
const client = new MongoClient(uri, {
authMechanismProperties: {
...
// get a token for the user (e.g. browser login)
OIDC_HUMAN_CALLBACK: async params => {
return { accessToken: await getUserToken(params) };
},
...
}
});dropIndexes no longer swallows all errors
Previously, dropIndexes swallowed almost all errors. With this change, dropIndexes will only swallow NamespaceNotFound server errors, and all other errors will be thrown as expected.
Node's autoSelectFamily process default is now respected
When autoSelectFamily is not set on the MongoClient, the driver no longer forces true, so --no-network-family-autoselection and net.setDefaultAutoSelectFamily(false) now apply to its sockets. Explicit driver options still take precedence.
Warning
Runtimes other than Node.js may have a different default for autoSelectFamily. Because the driver no longer sets true itself, that runtime default now applies. There is no change on Node.js 20 and later, where the default is true.
Thanks to @aniruddhaadak80 for the initial implementation!
Undeprecate single-parameter overload of createIndex
Recent work accidentally marked db.collection(collection).createIndex({ a: 1, b: 1 }); as deprecated.
The correct deprecation status of overloads is:
// not deprecated
db.collection(collection).createIndex({ a: 1, b: 1 });
// deprecated, removed in an upcoming major version
db.collection(collection).createIndex(
{ a: 1, b: 1 },
{/* mixed command and index options */});
// new, not deprecated
db.collection(collection).createIndex(
{ a: 1, b: 1 },
{/* index-related options */},
{/* command-related options */});Deprecated SelectServerOptions
SelectServerOptions is not intended for public use and will be made internal in the next major release.
Features
- NODE-7743: deprecate SelectServerOptions (#5108) (b22b432)
- NODE-7968: un-deprecate single parameter overload of
createIndex(#5106) (18f21e5)
Bug Fixes
- NODE-6517: drop indexes swallowing errors (#5100) (035bffb)
- NODE-7848: honor Node's process-level autoSelectFamily default (#5107) (7d64ea2)
Documentation
We invite you to try the mongodb library immediately, and report any issues to the NODE project.