JamesNK/Newtonsoft.Json · error · JsonSerializationException
Could not load assembly '{0}'.
Error message
Could not load assembly '{0}'. What it means
During deserialization with TypeNameHandling, DefaultSerializationBinder.BindToType tries to load the assembly named in the JSON $type. If the assembly cannot be loaded (not found via Assembly.Load, partial-name load, or among currently loaded assemblies), it throws a JsonSerializationException (line 99). This is the binder's way of rejecting a $type that references an unavailable assembly.
Source
Thrown at Src/Newtonsoft.Json/Serialization/DefaultSerializationBinder.cs:99
if (assembly == null)
{
// will find assemblies loaded with Assembly.LoadFile outside of the main directory
Assembly[] loadedAssemblies = AppDomain.CurrentDomain.GetAssemblies();
foreach (Assembly a in loadedAssemblies)
{
// check for both full name or partial name match
if (a.FullName == assemblyName || a.GetName().Name == assemblyName)
{
assembly = a;
break;
}
}
}
#endif
if (assembly == null)
{
throw new JsonSerializationException("Could not load assembly '{0}'.".FormatWith(CultureInfo.InvariantCulture, assemblyName));
}
Type? type = assembly.GetType(typeName);
if (type == null)
{
// if generic type, try manually parsing the type arguments for the case of dynamically loaded assemblies
// example generic typeName format: System.Collections.Generic.Dictionary`2[[System.String, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089],[System.String, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]
if (StringUtils.IndexOf(typeName, '`') >= 0)
{
try
{
type = GetGenericTypeFromTypeName(typeName, assembly);
}
catch (Exception ex)
{
throw new JsonSerializationException("Could not find type '{0}' in assembly '{1}'.".FormatWith(CultureInfo.InvariantCulture, typeName, assembly.FullName), ex);
}
}View on GitHub (pinned to 4f73e74372)
Solutions
- Ensure the assembly named in $type is referenced and available at runtime (deploy the DLL, add the reference).
- Use a custom SerializationBinder to remap assembly/type names to the ones available in your app.
- Avoid TypeNameHandling for cross-boundary payloads, or strip $type and deserialize to a known concrete type.
- Tighten TypeNameHandling scope (e.g. TypeNameHandling.None or Auto) so arbitrary external $type values are not honored.
Example fix
// before
var settings = new JsonSerializerSettings { TypeNameHandling = TypeNameHandling.All };
var obj = JsonConvert.DeserializeObject(json, settings); // $type names a missing assembly -> throws
// after
var settings = new JsonSerializerSettings {
TypeNameHandling = TypeNameHandling.Auto,
SerializationBinder = new SafeBinder()
};
// SafeBinder.BindToType remaps known assembly names to currently loaded assemblies Defensive patterns
Strategy: validation
Validate before calling
public sealed class SafeBinder : DefaultSerializationBinder {
public override Type BindToType(string assemblyName, string typeName) {
foreach (var a in AppDomain.CurrentDomain.GetAssemblies())
if (a.GetName().Name == assemblyName || a.FullName == assemblyName)
{
var t = a.GetType(typeName);
if (t != null) return t;
}
throw new JsonSerializationException($"Refusing to deserialize unknown assembly '{assemblyName}'.");
}
}
var settings = new JsonSerializerSettings {
TypeNameHandling = TypeNameHandling.Auto,
SerializationBinder = new SafeBinder()
}; Type guard
static bool AssemblyIsLoaded(string assemblyName) =>
AppDomain.CurrentDomain.GetAssemblies()
.Any(a => a.GetName().Name == assemblyName || a.FullName == assemblyName); Try / catch
try { return JsonConvert.DeserializeObject(json, type, settings); }
catch (JsonSerializationException ex) when (ex.Message.StartsWith("Could not load assembly"))
{
// log, reject the payload, or prompt for the missing assembly reference
} Prevention
- Always pair TypeNameHandling with a custom SerializationBinder that allowlists types.
- Do not use TypeNameHandling.All on untrusted input (RCE risk).
- Ensure producer and consumer reference the same assemblies and versions.
When it happens
Trigger: Deserializing JSON containing "$type": "Namespace.Type, Missing.Assembly" when that assembly is not referenced/loaded by the application.
Common situations: Type-name handling across service boundaries (the producer's assembly is not referenced by the consumer), deploying without a required assembly, or version/strong-name mismatches in the $type assembly name.
Related errors
- Could not find type '{0}' in assembly '{1}'.
- Unexpected BsonType value: {0}
- Unable to read beyond the end of the stream.
- Expected Bytes but got {0}.
- No object created.
AI-assisted analysis of JamesNK/Newtonsoft.Json@4f73e74372 (2026-08-07).
Data as JSON: /api/errors/f50a279189e1d2f8.
Report an issue: GitHub.