mongodb/node-mongodb-native · critical · MongoRuntimeError

No AutoEncrypter available for encryption

Error message

No AutoEncrypter available for encryption

What it means

Thrown in the AutoEncrypter-aware Connection subclass override (src/cmap/connection.ts:880-883) when a command reaches the auto-encrypt path but this.autoEncrypter is undefined. This Connection subclass is only instantiated when CSFLE/Queryable Encryption is configured; reaching command() with no autoEncrypter means the pool was created with autoEncrypter in its options but the connection object never received one - a misconfigured CSFLE setup or an internal wiring bug.

Source

Thrown at src/cmap/connection.ts:882

    options: CommandOptions | undefined,
    responseType: T
  ): Promise<InstanceType<T>>;

  public override async command(
    ns: MongoDBNamespace,
    command: Document,
    options?: CommandOptions
  ): Promise<Document>;

  override async command<T extends MongoDBResponseConstructor>(
    ns: MongoDBNamespace,
    cmd: Document,
    options?: CommandOptions,
    responseType?: T
  ): Promise<Document> {
    const { autoEncrypter } = this;
    if (!autoEncrypter) {
      throw new MongoRuntimeError('No AutoEncrypter available for encryption');
    }

    const serverWireVersion = maxWireVersion(this);
    if (serverWireVersion === 0) {
      // This means the initial handshake hasn't happened yet
      return await super.command<T>(ns, cmd, options, responseType);
    }

    // Save sort or indexKeys based on the command being run
    // the encrypt API serializes our JS objects to BSON to pass to the native code layer
    // and then deserializes the encrypted result, the protocol level components
    // of the command (ex. sort) are then converted to JS objects potentially losing
    // import key order information. These fields are never encrypted so we can save the values
    // from before the encryption and replace them after encryption has been performed
    const sort: Map<string, number> | null = cmd.find || cmd.findAndModify ? cmd.sort : null;
    const indexKeys: Map<string, number>[] | null = cmd.createIndexes
      ? cmd.indexes.map((index: { key: Map<string, number> }) => index.key)
      : null;

View on GitHub (pinned to 3366c21a63)

Solutions

1. Install mongodb-client-encryption and ensure libmongocrypt is present for your platform.
2. Verify autoEncryption.keyVaultClient / kmsProviders / schemaMap are correctly configured so the AutoEncrypter constructs successfully.
3. Check driver logs at connect time for an AutoEncrypter construction error that was logged but not surfaced.
4. Align the driver version with a compatible mongodb-client-encryption release.

Example fix

// before
const client = new MongoClient(uri, { autoEncryption: { kmsProviders, keyVaultClient } }); // native dep missing

// after
// npm install mongodb-client-encryption
const client = new MongoClient(uri, { autoEncryption: { kmsProviders, keyVaultNamespace: 'enc.__keyVault' } });

import { MongoClient } from 'mongodb';
async function assertAutoEncrypterReady(uri: string, opts: any) {
  if (!opts.autoEncryption) return;
  let mod: any;
  try { mod = await import('mongodb-client-encryption'); }
  catch { throw new Error('mongodb-client-encryption is required for autoEncryption'); }
  if (!mod) throw new Error('failed to load mongodb-client-encryption');
}

function hasValidAutoEncryptionConfig(opts: any): boolean {
  return Boolean(opts.autoEncryption) &&
    Boolean(opts.autoEncryption.kmsProviders) &&
    Boolean(opts.autoEncryption.keyVaultNamespace || opts.autoEncryption.keyVaultClient);
}

import { MongoRuntimeError } from 'mongodb';
try {
  await client.db().command({ ping: 1 });
} catch (e) {
  if (e instanceof MongoRuntimeError && /AutoEncrypter/.test(e.message)) {
    // install mongodb-client-encryption, fix libmongocrypt, then recreate the client
  }
  throw e;
}

When it happens

Trigger: Enabling autoEncryption on MongoClient but the autoEncrypter failed to initialize (mongodb-client-encryption native module missing or broken), yet the connection class was still swapped to the crypto-aware variant. Fires on the very first command through the encrypted connection.

Common situations: mongodb-client-encryption (or its libmongocrypt dependency) not installed or not built for the platform; SharedModuleRef to the autoEncrypter returned undefined due to an init error that was swallowed; mixing a CSFLE-enabled MongoClient with a manually constructed Connection/Pool; mismatched versions between driver and mongodb-client-encryption.

Related errors

• Cannot set both proxyOptions and kmsConnectCallback
• Can only provide a custom AWS credential provider when the s
• `cryptSharedLibRequired` set but no crypt_shared library loa
• Cannot set both proxyOptions and kmsConnectCallback
• Can only provide a custom AWS credential provider when the s

AI-assisted analysis of mongodb/node-mongodb-native@3366c21a63 (2026-08-04). Data as JSON: /data/errors/926242488f689341.json. Report an issue: GitHub.