BSON ingest validation and wireObjectCheck deprecation boundaries
Parent: MongoDB Security Architecture · Published reference · snapshot 2026-10-29
↓ Facts as markdownall context files
Source-anchored research for BSON ingest validation and wireObjectCheck deprecation boundaries. Run status: COMPLETED.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
Structure and components
- In the reviewed snapshots, the 9.0 compatibility page contains neither wireObjectCheck nor objcheck, and the server-parameters page contains no wireObjectCheck or bsonValidate control. Those pages therefore do not provide a documented replacement switch or resolve explicit-disable semantics. (medium confidence) (verified as of 2026-10-14) [source]
How it works
- The 9.0 configuration reference still describes net.wireObjectCheck as a boolean defaulting to true and describes validation when true. Deprecation wording alone does not establish that setting false is rejected, ignored, or still effective. The release notes use default-on language, so the runtime effect of that server setting requires additional evidence. (medium confidence) (verified as of 2026-09-28) [source]
Problems, failure modes and limitations
- MongoDB 9.0 release notes deprecate net.wireObjectCheck and the corresponding object-check CLI controls, state that the server validates all ingested BSON by default, and say invalid BSON produces an error. The configuration reference also marks the setting deprecated since 9.0. (high confidence) (verified as of 2026-09-28) [source]
- The 9.0 configuration reference marks net.wireObjectCheck deprecated since 9.0 but still lists its type as boolean and default as true. The versioned 8.0 reference also lists default true, so the 9.0 announcement should not be described as the first introduction of enabled-by-default client BSON checks. (high confidence) (verified as of 2026-10-14) [source]
- The mongorestore reference explicitly says its --objcheck option is deprecated since MongoDB 9.0 and has no effect on server behavior because the server always validates BSON. This stronger wording documents the restore option boundary; it does not by itself demonstrate how a server started with net.wireObjectCheck=false behaves. (medium confidence) (verified as of 2026-09-28) [source]
- A separate MongoDB wire parser can fail before MongoDB server validation provides any protection. The OpenTelemetry eBPF instrumentation advisory describes malformed OP_MSG and BSON causing telemetry-agent panics; this is a boundary of the independent observer parser, not evidence that MongoDB 9.0 BSON validation itself is broken. (medium confidence) (verified as of 2026-05-12) [source]
- MongoDB 9.0 release notes say the server validates all ingested BSON objects by default and returns an error for invalid BSON. The configuration reference describes net.wireObjectCheck as validating client requests upon receipt when true. (medium confidence) (verified as of 2026-10-14) [source]
- The validate command's checkBSONConformance option was added in 6.2, defaults to false, increases validation time, and reports conformance issues as warnings. It cannot be combined with repair=true or metadata=true. These are command-specific rules, not settings for BSON ingestion. (low confidence) (verified as of 2026-10-14) [source]
Facts and statements
- Schema validation enforces application field rules such as allowed types and value ranges; BSON receipt checks address malformed or invalid BSON. MongoDB's flexible schema does not require identical fields or types by default. A valid BSON object therefore does not, by itself, establish compliance with an application's schema. (high confidence) [source]
- The validate command checks data and indexes already in a collection. Its checkBSONConformance option checks stored BSON conformance and reports issues as warnings. These maintenance checks are a different operation from validation of incoming client requests. (high confidence) [source]
- Historical flag changes belong to specific executables: TOOLS-501 records removal of mongorestore noobjcheck in 2.8.0-rc3, while SERVER-26638 adds undocumented objcheck/noobjcheck options to the legacy mongo shell for 3.4.0-rc1 performance tests. Neither ticket establishes removal of the MongoDB 9.0 server configuration setting. (medium confidence) [source]
- Do not treat structural BSON validation as a complete NoSQL-injection defense. OWASP and PortSwigger show operator injection through nested objects such as a client-controlled $ne value and recommend validating input types or allowed keys. The distinction from malformed-BSON protection follows from comparing those examples with MongoDB's description of wireObjectCheck. (high confidence) [source]
- Collection validation and receipt-time checks have different scopes. net.wireObjectCheck concerns incoming client requests, whereas the validate command examines a named collection and offers additional BSON conformance checks on its stored documents. (medium confidence) [source]
Children
- No children recorded.