JamesNK/Newtonsoft.Json · critical · JsonException

Insufficient permissions. Creating an uninitialized '{0}' ty

Error message

Insufficient permissions. Creating an uninitialized '{0}' type requires full trust.

What it means

Thrown by JsonObjectContract.GetUninitializedObject when JsonTypeReflector.FullyTrusted returns false but the serializer needs to allocate an ISerializable type without invoking its constructor (FormatterServices.GetUninitializedObject). The '{0}' is the non-nullable underlying type. This path is gated by the HAVE_BINARY_FORMATTER compile switch and the runtime trust level.

Source

Thrown at Src/Newtonsoft.Json/Serialization/JsonObjectContract.cs:196

        public JsonObjectContract(Type underlyingType)
            : base(underlyingType)
        {
            ContractType = JsonContractType.Object;

            Properties = new JsonPropertyCollection(UnderlyingType);
        }

#if HAVE_BINARY_FORMATTER
#if HAVE_SECURITY_SAFE_CRITICAL_ATTRIBUTE
        [SecuritySafeCritical]
#endif
        internal object GetUninitializedObject()
        {
#pragma warning disable SYSLIB0050
            // we should never get here if the environment is not fully trusted, check just in case
            if (!JsonTypeReflector.FullyTrusted)
            {
                throw new JsonException("Insufficient permissions. Creating an uninitialized '{0}' type requires full trust.".FormatWith(CultureInfo.InvariantCulture, NonNullableUnderlyingType));
            }

            return FormatterServices.GetUninitializedObject(NonNullableUnderlyingType);
#pragma warning restore SYSLIB0050
        }
#endif
    }
}

View on GitHub (pinned to 4f73e74372)

Solutions

1. Run the application in a fully-trusted AppDomain (most modern .NET Core/.NET 5+ hosting is fully trusted by default).
2. Avoid ISerializable on types you serialize to JSON; use plain POCOs instead so the uninitialized-allocation path is never taken.
3. If you control the host, raise the trust level (legacy ASP.NET: <trust level="Full"/>).
4. Migrate to a target where HAVE_BINARY_FORMATTER is undefined (the GetUninitializedObject path is compiled out).

Example fix

// before
[Serializable]
public class Settings : ISerializable { ... }
JsonConvert.Deserialize<Settings>(json); // partial trust throws
// after
public class Settings { public Settings() {} public string Key { get; set; } }

if (!AppDomain.CurrentDomain.IsFullyTrusted) throw new InvalidOperationException("requires full trust");

try { JsonConvert.DeserializeObject<ISerializableType>(json); }
catch (JsonException ex) when (ex.Message.Contains("Insufficient permissions")) {
    logger.Error(ex, "ISerializable deser requires full trust; raise trust level or use a POCO."); throw;
}

When it happens

Trigger: Deserializing an ISerializable type in a partial-trust or sandboxed AppDomain where FormatterServices.GetUninitializedObject requires full trust. Triggered by the ISerializable deserialization pipeline when it must pre-allocate the object bypassing the constructor.

Common situations: Running Json.NET in a medium-trust hosting environment (legacy ASP.NET medium trust, sandboxed AppDomain, partial-trust Azure web/worker roles), or on a target framework where HAVE_BINARY_FORMATTER is defined but the AppDomain is not fully trusted.

Related errors

• Unexpected token when writing BSON: {0}
• Unexpected value type when writing binary: {0}
• CustomCreationConverter should only be used while deserializ
• Unexpected value when converting date. Expected DateTime or
• Expected date object value.

AI-assisted analysis of JamesNK/Newtonsoft.Json@4f73e74372 (2026-08-07). Data as JSON: /api/errors/da4d815a478d559c. Report an issue: GitHub.