Warning
Driver versions v2.1.0 through v2.8.1 are affected by a security issue CVE-2026-81521 in
Client.BulkWritethat is fixed in this release (v2.8.2). Users are encouraged to upgrade to this version as soon as possible.
The MongoDB Go Driver Team is pleased to release version 2.8.2 of the MongoDB Go Driver.
This release addresses CVE-2026-81521, a security issue in calling Client.BulkWrite. A caller-controlled database name containing a period (‘.’) may be interpreted as a different namespace when forwarded to MongoDB. This could redirect operations to a database or collection other than the one intended by the application.
It also fixes a bug in Collection.BulkWrite where, for unordered bulk writes split across multiple batches, a write-concern error from an earlier batch could be non-deterministically silently dropped or replaced by subsequent batches.
For more information please see the 2.8.2 release notes.
You can obtain the driver source from GitHub under the v2.8.2 tag.
Documentation for the Go Driver can be found on pkg.go.dev and the
BSON library documentation is also available on pkg.go.dev.
For issues with, questions about, or feedback for the Go Driver, please look into our support channels, including StackOverflow.
Bugs can be reported in the Go Driver project in the MongoDB JIRA
where a list of current issues can be found.
Your feedback on the Go Driver is greatly appreciated!
Thank you,
The Go Driver Team