{"record":{"id":"f50a279189e1d2f8","repo":"JamesNK/Newtonsoft.Json","slug":"could-not-load-assembly-0","errorCode":null,"errorMessage":"Could not load assembly '{0}'.","messagePattern":"Could not load assembly '(.+?)'\\.","errorType":"exception","errorClass":"JsonSerializationException","httpStatus":null,"severity":"error","filePath":"Src/Newtonsoft.Json/Serialization/DefaultSerializationBinder.cs","lineNumber":99,"sourceCode":"                if (assembly == null)\n                {\n                    // will find assemblies loaded with Assembly.LoadFile outside of the main directory\n                    Assembly[] loadedAssemblies = AppDomain.CurrentDomain.GetAssemblies();\n                    foreach (Assembly a in loadedAssemblies)\n                    {\n                        // check for both full name or partial name match\n                        if (a.FullName == assemblyName || a.GetName().Name == assemblyName)\n                        {\n                            assembly = a;\n                            break;\n                        }\n                    }\n                }\n#endif\n\n                if (assembly == null)\n                {\n                    throw new JsonSerializationException(\"Could not load assembly '{0}'.\".FormatWith(CultureInfo.InvariantCulture, assemblyName));\n                }\n\n                Type? type = assembly.GetType(typeName);\n                if (type == null)\n                {\n                    // if generic type, try manually parsing the type arguments for the case of dynamically loaded assemblies\n                    // example generic typeName format: System.Collections.Generic.Dictionary`2[[System.String, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089],[System.String, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]\n                    if (StringUtils.IndexOf(typeName, '`') >= 0)\n                    {\n                        try\n                        {\n                            type = GetGenericTypeFromTypeName(typeName, assembly);\n                        }\n                        catch (Exception ex)\n                        {\n                            throw new JsonSerializationException(\"Could not find type '{0}' in assembly '{1}'.\".FormatWith(CultureInfo.InvariantCulture, typeName, assembly.FullName), ex);\n                        }\n                    }","sourceCodeStart":81,"sourceCodeEnd":117,"githubUrl":"https://github.com/JamesNK/Newtonsoft.Json/blob/4f73e74372445108d2c1bda37b36e6f5e43402e0/Src/Newtonsoft.Json/Serialization/DefaultSerializationBinder.cs#L81-L117","documentation":"During deserialization with TypeNameHandling, DefaultSerializationBinder.BindToType tries to load the assembly named in the JSON $type. If the assembly cannot be loaded (not found via Assembly.Load, partial-name load, or among currently loaded assemblies), it throws a JsonSerializationException (line 99). This is the binder's way of rejecting a $type that references an unavailable assembly.","triggerScenarios":"Deserializing JSON containing \"$type\": \"Namespace.Type, Missing.Assembly\" when that assembly is not referenced/loaded by the application.","commonSituations":"Type-name handling across service boundaries (the producer's assembly is not referenced by the consumer), deploying without a required assembly, or version/strong-name mismatches in the $type assembly name.","solutions":["Ensure the assembly named in $type is referenced and available at runtime (deploy the DLL, add the reference).","Use a custom SerializationBinder to remap assembly/type names to the ones available in your app.","Avoid TypeNameHandling for cross-boundary payloads, or strip $type and deserialize to a known concrete type.","Tighten TypeNameHandling scope (e.g. TypeNameHandling.None or Auto) so arbitrary external $type values are not honored."],"exampleFix":"// before\nvar settings = new JsonSerializerSettings { TypeNameHandling = TypeNameHandling.All };\nvar obj = JsonConvert.DeserializeObject(json, settings); // $type names a missing assembly -> throws\n\n// after\nvar settings = new JsonSerializerSettings {\n    TypeNameHandling = TypeNameHandling.Auto,\n    SerializationBinder = new SafeBinder()\n};\n// SafeBinder.BindToType remaps known assembly names to currently loaded assemblies","handlingStrategy":"validation","validationCode":"public sealed class SafeBinder : DefaultSerializationBinder {\n    public override Type BindToType(string assemblyName, string typeName) {\n        foreach (var a in AppDomain.CurrentDomain.GetAssemblies())\n            if (a.GetName().Name == assemblyName || a.FullName == assemblyName)\n            {\n                var t = a.GetType(typeName);\n                if (t != null) return t;\n            }\n        throw new JsonSerializationException($\"Refusing to deserialize unknown assembly '{assemblyName}'.\");\n    }\n}\nvar settings = new JsonSerializerSettings {\n    TypeNameHandling = TypeNameHandling.Auto,\n    SerializationBinder = new SafeBinder()\n};","typeGuard":"static bool AssemblyIsLoaded(string assemblyName) =>\n    AppDomain.CurrentDomain.GetAssemblies()\n        .Any(a => a.GetName().Name == assemblyName || a.FullName == assemblyName);","tryCatchPattern":"try { return JsonConvert.DeserializeObject(json, type, settings); }\ncatch (JsonSerializationException ex) when (ex.Message.StartsWith(\"Could not load assembly\"))\n{\n    // log, reject the payload, or prompt for the missing assembly reference\n}","preventionTips":["Always pair TypeNameHandling with a custom SerializationBinder that allowlists types.","Do not use TypeNameHandling.All on untrusted input (RCE risk).","Ensure producer and consumer reference the same assemblies and versions."],"tags":["deserialization","type-name-handling","assembly-loading","serialization-binder","security"],"analyzedSha":"4f73e74372445108d2c1bda37b36e6f5e43402e0","analyzedAt":"2026-08-07T06:10:08.596Z","schemaVersion":2},"datasetVersion":"2026-08-07T07:17:06.508Z"}