mongodb/node-mongodb-native · error · MongoRuntimeError

Server returned an invalid host: "${host}"

Error message

Server returned an invalid host: "${host}"

What it means

Thrown during MONGODB-AWS auth when the host string returned by the server (the 'h' field of the saslStart response) fails validation: it must be 1-255 characters and must not contain '..' (src/cmap/auth/mongodb_aws.ts:93). This guards against the server directing the driver to sign requests for an attacker-controlled or path-traversal style host. Surfaced as a MongoRuntimeError.

Source

Thrown at src/cmap/auth/mongodb_aws.ts:95

    };
    const host = serverResponse.h;
    const serverNonce = serverResponse.s.buffer;
    if (serverNonce.length !== 64) {
      // TODO(NODE-3483)
      throw new MongoRuntimeError(`Invalid server nonce length ${serverNonce.length}, expected 64`);
    }

    if (!ByteUtils.equals(serverNonce.subarray(0, nonce.byteLength), nonce)) {
      // throw because the serverNonce's leading 32 bytes must equal the client nonce's 32 bytes
      // https://github.com/mongodb/specifications/blob/master/source/auth/auth.md#conversation-5

      // TODO(NODE-3483)
      throw new MongoRuntimeError('Server nonce does not begin with client nonce');
    }

    if (host.length < 1 || host.length > 255 || host.indexOf('..') !== -1) {
      // TODO(NODE-3483)
      throw new MongoRuntimeError(`Server returned an invalid host: "${host}"`);
    }

    const body = 'Action=GetCallerIdentity&Version=2011-06-15';
    const headers = await aws4Sign(
      {
        method: 'POST',
        host,
        region: deriveRegion(serverResponse.h),
        service: 'sts',
        headers: {
          'Content-Type': 'application/x-www-form-urlencoded',
          'Content-Length': body.length,
          'X-MongoDB-Server-Nonce': ByteUtils.toBase64(serverNonce),
          'X-MongoDB-GS2-CB-Flag': 'n'
        },
        path: '/',
        body,
        date: new Date()

View on GitHub (pinned to 3366c21a63)

Solutions

1. Confirm the MongoDB server is a legitimate Enterprise deployment with AWS auth correctly configured.
2. Check that no proxy/LB is rewriting the saslStart response.
3. If running a custom/mock server, ensure it returns a valid AWS STS hostname in the 'h' field (e.g. sts.us-east-1.amazonaws.com).
4. Report to your DBA/server vendor if the host looks malformed against a real MongoDB server.

try {
  await client.connect();
} catch (e) {
  if (e instanceof MongoRuntimeError && /Server returned an invalid host/.test(e.message)) {
    log.error('Server returned a suspect AWS host; do not proceed', e);
  }
  throw e;
}

When it happens

Trigger: The server returns an empty host, a host longer than 255 chars, or a host containing '..' in its 'h' field of the saslStart response. The driver refuses to derive a region and sign an STS GetCallerIdentity request for such a host.

Common situations: A misconfigured server-side AWS authentication integration returning a malformed_STS hostname, a non-conformant or compromised server, or an intermediary mangling the response. Not a client-config issue; the client is protecting itself.

Related errors

• Server nonce does not begin with client nonce
• username and password cannot be provided when using MONGODB-
• AWS_SESSION_TOKEN cannot be provided when using MONGODB-AWS.
• Invalid source '${this.source}' for mechanism '${this.mechan
• AuthContext must provide credentials.

AI-assisted analysis of mongodb/node-mongodb-native@3366c21a63 (2026-08-04). Data as JSON: /data/errors/8ca04947dd62c976.json. Report an issue: GitHub.