{"id":"926242488f689341","repo":"mongodb/node-mongodb-native","slug":"no-autoencrypter-available-for-encryption","errorCode":null,"errorMessage":"No AutoEncrypter available for encryption","messagePattern":"No AutoEncrypter available for encryption","errorType":"exception","errorClass":"MongoRuntimeError","httpStatus":null,"severity":"critical","filePath":"src/cmap/connection.ts","lineNumber":882,"sourceCode":"    options: CommandOptions | undefined,\n    responseType: T\n  ): Promise<InstanceType<T>>;\n\n  public override async command(\n    ns: MongoDBNamespace,\n    command: Document,\n    options?: CommandOptions\n  ): Promise<Document>;\n\n  override async command<T extends MongoDBResponseConstructor>(\n    ns: MongoDBNamespace,\n    cmd: Document,\n    options?: CommandOptions,\n    responseType?: T\n  ): Promise<Document> {\n    const { autoEncrypter } = this;\n    if (!autoEncrypter) {\n      throw new MongoRuntimeError('No AutoEncrypter available for encryption');\n    }\n\n    const serverWireVersion = maxWireVersion(this);\n    if (serverWireVersion === 0) {\n      // This means the initial handshake hasn't happened yet\n      return await super.command<T>(ns, cmd, options, responseType);\n    }\n\n    // Save sort or indexKeys based on the command being run\n    // the encrypt API serializes our JS objects to BSON to pass to the native code layer\n    // and then deserializes the encrypted result, the protocol level components\n    // of the command (ex. sort) are then converted to JS objects potentially losing\n    // import key order information. These fields are never encrypted so we can save the values\n    // from before the encryption and replace them after encryption has been performed\n    const sort: Map<string, number> | null = cmd.find || cmd.findAndModify ? cmd.sort : null;\n    const indexKeys: Map<string, number>[] | null = cmd.createIndexes\n      ? cmd.indexes.map((index: { key: Map<string, number> }) => index.key)\n      : null;","sourceCodeStart":864,"sourceCodeEnd":900,"githubUrl":"https://github.com/mongodb/node-mongodb-native/blob/3366c21a6311e02f1be91da982f9b93d3cce99a0/src/cmap/connection.ts#L864-L900","documentation":"Thrown in the AutoEncrypter-aware Connection subclass override (src/cmap/connection.ts:880-883) when a command reaches the auto-encrypt path but this.autoEncrypter is undefined. This Connection subclass is only instantiated when CSFLE/Queryable Encryption is configured; reaching command() with no autoEncrypter means the pool was created with autoEncrypter in its options but the connection object never received one - a misconfigured CSFLE setup or an internal wiring bug.","triggerScenarios":"Enabling autoEncryption on MongoClient but the autoEncrypter failed to initialize (mongodb-client-encryption native module missing or broken), yet the connection class was still swapped to the crypto-aware variant. Fires on the very first command through the encrypted connection.","commonSituations":"mongodb-client-encryption (or its libmongocrypt dependency) not installed or not built for the platform; SharedModuleRef to the autoEncrypter returned undefined due to an init error that was swallowed; mixing a CSFLE-enabled MongoClient with a manually constructed Connection/Pool; mismatched versions between driver and mongodb-client-encryption.","solutions":["Install mongodb-client-encryption and ensure libmongocrypt is present for your platform.","Verify autoEncryption.keyVaultClient / kmsProviders / schemaMap are correctly configured so the AutoEncrypter constructs successfully.","Check driver logs at connect time for an AutoEncrypter construction error that was logged but not surfaced.","Align the driver version with a compatible mongodb-client-encryption release."],"exampleFix":"// before\nconst client = new MongoClient(uri, { autoEncryption: { kmsProviders, keyVaultClient } }); // native dep missing\n\n// after\n// npm install mongodb-client-encryption\nconst client = new MongoClient(uri, { autoEncryption: { kmsProviders, keyVaultNamespace: 'enc.__keyVault' } });","handlingStrategy":"validation","validationCode":"import { MongoClient } from 'mongodb';\nasync function assertAutoEncrypterReady(uri: string, opts: any) {\n  if (!opts.autoEncryption) return;\n  let mod: any;\n  try { mod = await import('mongodb-client-encryption'); }\n  catch { throw new Error('mongodb-client-encryption is required for autoEncryption'); }\n  if (!mod) throw new Error('failed to load mongodb-client-encryption');\n}","typeGuard":"function hasValidAutoEncryptionConfig(opts: any): boolean {\n  return Boolean(opts.autoEncryption) &&\n    Boolean(opts.autoEncryption.kmsProviders) &&\n    Boolean(opts.autoEncryption.keyVaultNamespace || opts.autoEncryption.keyVaultClient);\n}","tryCatchPattern":"import { MongoRuntimeError } from 'mongodb';\ntry {\n  await client.db().command({ ping: 1 });\n} catch (e) {\n  if (e instanceof MongoRuntimeError && /AutoEncrypter/.test(e.message)) {\n    // install mongodb-client-encryption, fix libmongocrypt, then recreate the client\n  }\n  throw e;\n}","preventionTips":["Install mongodb-client-encryption and a compatible libmongocrypt before enabling autoEncryption.","Validate autoEncryption.keyVaultNamespace and kmsProviders at config load time.","Pin driver and mongodb-client-encryption versions to a tested-compatible pair."],"tags":["csfle","encryption","auto-encryption","configuration"],"analyzedSha":"3366c21a6311e02f1be91da982f9b93d3cce99a0","analyzedAt":"2026-08-04T13:40:15.335Z","schemaVersion":2}