{"id":"8ca04947dd62c976","repo":"mongodb/node-mongodb-native","slug":"server-returned-an-invalid-host-host","errorCode":null,"errorMessage":"Server returned an invalid host: \"${host}\"","messagePattern":"Server returned an invalid host: \"(.+?)\"","errorType":"exception","errorClass":"MongoRuntimeError","httpStatus":null,"severity":"error","filePath":"src/cmap/auth/mongodb_aws.ts","lineNumber":95,"sourceCode":"    };\n    const host = serverResponse.h;\n    const serverNonce = serverResponse.s.buffer;\n    if (serverNonce.length !== 64) {\n      // TODO(NODE-3483)\n      throw new MongoRuntimeError(`Invalid server nonce length ${serverNonce.length}, expected 64`);\n    }\n\n    if (!ByteUtils.equals(serverNonce.subarray(0, nonce.byteLength), nonce)) {\n      // throw because the serverNonce's leading 32 bytes must equal the client nonce's 32 bytes\n      // https://github.com/mongodb/specifications/blob/master/source/auth/auth.md#conversation-5\n\n      // TODO(NODE-3483)\n      throw new MongoRuntimeError('Server nonce does not begin with client nonce');\n    }\n\n    if (host.length < 1 || host.length > 255 || host.indexOf('..') !== -1) {\n      // TODO(NODE-3483)\n      throw new MongoRuntimeError(`Server returned an invalid host: \"${host}\"`);\n    }\n\n    const body = 'Action=GetCallerIdentity&Version=2011-06-15';\n    const headers = await aws4Sign(\n      {\n        method: 'POST',\n        host,\n        region: deriveRegion(serverResponse.h),\n        service: 'sts',\n        headers: {\n          'Content-Type': 'application/x-www-form-urlencoded',\n          'Content-Length': body.length,\n          'X-MongoDB-Server-Nonce': ByteUtils.toBase64(serverNonce),\n          'X-MongoDB-GS2-CB-Flag': 'n'\n        },\n        path: '/',\n        body,\n        date: new Date()","sourceCodeStart":77,"sourceCodeEnd":113,"githubUrl":"https://github.com/mongodb/node-mongodb-native/blob/3366c21a6311e02f1be91da982f9b93d3cce99a0/src/cmap/auth/mongodb_aws.ts#L77-L113","documentation":"Thrown during MONGODB-AWS auth when the host string returned by the server (the 'h' field of the saslStart response) fails validation: it must be 1-255 characters and must not contain '..' (src/cmap/auth/mongodb_aws.ts:93). This guards against the server directing the driver to sign requests for an attacker-controlled or path-traversal style host. Surfaced as a MongoRuntimeError.","triggerScenarios":"The server returns an empty host, a host longer than 255 chars, or a host containing '..' in its 'h' field of the saslStart response. The driver refuses to derive a region and sign an STS GetCallerIdentity request for such a host.","commonSituations":"A misconfigured server-side AWS authentication integration returning a malformed_STS hostname, a non-conformant or compromised server, or an intermediary mangling the response. Not a client-config issue; the client is protecting itself.","solutions":["Confirm the MongoDB server is a legitimate Enterprise deployment with AWS auth correctly configured.","Check that no proxy/LB is rewriting the saslStart response.","If running a custom/mock server, ensure it returns a valid AWS STS hostname in the 'h' field (e.g. sts.us-east-1.amazonaws.com).","Report to your DBA/server vendor if the host looks malformed against a real MongoDB server."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  await client.connect();\n} catch (e) {\n  if (e instanceof MongoRuntimeError && /Server returned an invalid host/.test(e.message)) {\n    log.error('Server returned a suspect AWS host; do not proceed', e);\n  }\n  throw e;\n}","preventionTips":["Connect only to trusted MongoDB Enterprise servers with correctly configured AWS auth.","Keep TLS enabled so the saslStart response cannot be tampered with in transit.","Treat this error as a potential security incident - it indicates the server tried to redirect signing to an odd host."],"tags":["auth","aws","security","ssrf-protection","wire-protocol"],"analyzedSha":"3366c21a6311e02f1be91da982f9b93d3cce99a0","analyzedAt":"2026-08-04T13:40:15.335Z","schemaVersion":2}