mongodb/node-mongodb-native · critical · MongoInvalidArgumentError

Connection must have host and port and credentials defined.

Error message

Connection must have host and port and credentials defined.

What it means

Internal guard in makeKerberosClient: the connection has no hostAddress.host or no credentials, so a Kerberos client cannot be initialised. It is a MongoInvalidArgumentError thrown before the kerberos library is loaded. Normally the SDAM layer guarantees a host; hitting this means the connection/stream was misconstructed or already closed.

Source

Thrown at src/cmap/auth/gssapi.ts:76

      saslContinue(negotiatedPayload, saslStartResponse.conversationId)
    );

    const finalizePayload = await finalize(client, username, saslContinueResponse.payload);

    await externalCommand(connection, {
      saslContinue: 1,
      conversationId: saslContinueResponse.conversationId,
      payload: finalizePayload
    });
  }
}

async function makeKerberosClient({
  options: { hostAddress, runtime },
  credentials
}: AuthContext): Promise<KerberosClient> {
  if (!hostAddress || typeof hostAddress.host !== 'string' || !credentials) {
    throw new MongoInvalidArgumentError(
      'Connection must have host and port and credentials defined.'
    );
  }

  const { os } = await runtime;

  loadKrb();
  if ('kModuleError' in krb) {
    throw krb['kModuleError'];
  }
  const { initializeClient } = krb;

  const { username, password } = credentials;
  const mechanismProperties = credentials.mechanismProperties as MechanismProperties;

  const serviceName = mechanismProperties.SERVICE_NAME ?? 'mongodb';

  const host = await performGSSAPICanonicalizeHostName(hostAddress.host, mechanismProperties);

View on GitHub (pinned to dce7939f86)

Solutions

1. Use the standard MongoClient connection path — do not construct AuthContext/Connection manually.
2. If this appears in tests, ensure mocks provide a hostAddress with a string host and a credentials object.
3. Upgrade the driver; a missing hostAddress during GSSAPI is usually an internal-lifecycle defect that gets fixed.

When it happens

Trigger: An AuthContext built from a connection whose hostAddress is undefined (e.g. mocking or a torn-down connection); credentials cleared between server selection and auth; a driver-internal wiring problem after a topology change.

Common situations: Driver bug in connection lifecycle; custom AuthProvider/test harness creating an AuthContext without a host; GSSAPI attempted on a connection that lost its endpoint.

Related errors

• Credentials required for GSSAPI authentication
• Reauthentication already in progress.
• Invalid CANONICALIZE_HOST_NAME value: ${canonicalization}
• No auth context found on connection.
• Reauthenticate failed due to no auth provider for ${credenti

AI-assisted analysis of mongodb/node-mongodb-native@dce7939f86 (2026-08-11). Data as JSON: /api/errors/25c84de3cf7688ce. Report an issue: GitHub.