We’re happy to announce the release of GroupDocs.Merger for .NET v26.10, available as of October 2026. This release introduces major enhancements for controlling external resource loading, resolves critical concurrency issues in EPUB and TeX processing, improves EPUB pagination, preserves PDF format and title in auto-tagged output, and fixes several .NET Framework–related failures. Overall, it includes 10 features, improvements, and bug fixes.

What’s new in this release

  • [Feature] Skip loading external resources by default, with a whitelist of trusted locations and a per-resource handler
  • [Bug] Fix NullReferenceException for EPUB documents whose table of contents file does not have the .ncx extension
  • [Bug] Fix image joins failing to load System.ValueTuple in .NET Framework packages.config projects
  • [Bug] Fix joins with SVG documents failing on .NET Framework 4.6.2 to 4.7.0 runtimes
  • [Bug] Render fixed-layout EPUB pages one per book page instead of splitting each in two
  • [Bug] Update System.Security.Cryptography.Pkcs to 8.0.2 and 9.0.21 (CVE-2026-84008, CVE-2026-70162)
  • [Bug] Keep the original PDF format and title when saving with auto-tagging enabled
  • [Bug] Fix an ArgumentException when TeX documents are loaded concurrently
  • [Bug] Save LowCode output given as a bare file name to the current directory and reject joined documents of another format
  • [Bug] Fix EPUB documents intermittently failing with NullReferenceException or IndexOutOfRangeException when processed concurrently

Public API changes

1. External resources — denied by default (new API, backward incompatible)

New public types in the GroupDocs.Merger.Domain.Options namespace:

Type Description
IResourceLoadingOptions Defines SkipExternalResources, WhitelistedResources and ExternalResourceHandler. LoadOptions implements it.
IExternalResourceHandler Its OnLoading method is called for each external resource before it is loaded and can allow, skip or replace it.
ExternalResourceLoadingArgs The resource passed to OnLoading: Uri, Skipped (pre-set to the decision of the other two options) and Data (content to use instead of loading the resource).

New properties of LoadOptions:

  • SkipExternalResources — true by default in every constructor. While true, no external resource is loaded except those matching WhitelistedResources or allowed by the handler.
  • WhitelistedResources — absolute URI prefixes of resources that are loaded while SkipExternalResources is true, for example https://cdn.example.com/assets/ or file:///C:/assets/. Empty by default.
  • ExternalResourceHandler — null by default.

Backward incompatible changes:

  • External resources are no longer loaded by default. Remote resources (http, https, ftp and other schemes), UNC paths, local files, including files in the document’s own folder, and relative references that point outside the document are skipped, and the operation continues. Earlier versions loaded them. Remote images and stylesheets of HTML, Word and presentation documents can therefore be missing from the output, and the page count of HTML and Word documents can change. Content the document carries — data: URIs, cid: references, MHTML parts and packaged media — still loads. To load external resources, whitelist their locations, or set SkipExternalResources to false for documents you trust.
  • LoadOptions is now sealed. A class derived from it no longer compiles. Use LoadOptions directly, or implement ILoadOptions; a custom ILoadOptions implementation that does not also implement IResourceLoadingOptions gets the default policy.
  • A WhitelistedResources entry that is null, empty, not an absolute URI, carries a query or fragment, or contains %2F, %5C or %2E makes the Merger constructor throw ArgumentException (“Whitelisted resource ‘…’ must be an absolute URI without a query, fragment or encoded ‘/’, ‘\’ or ‘.’.”).
  • If the handler throws, the resource is skipped and the operation throws GroupDocsMergerException (“The external resource handler threw an exception; the resource was skipped. See the inner exception.”) with the handler’s exception as InnerException.
  • EPUB documents, and SVG and SVGZ documents in some operations, now have their markup checked for external references. A document whose markup is not well-formed XML fails with GroupDocsMergerException (“The document’s markup could not be read to check it for external resources, so it was not loaded. Set SkipExternalResources to false without an ExternalResourceHandler to load it without the check.”).
  • The OleDiagramOptions, OleSpreadsheetOptions and OleWordProcessingOptions constructors that take a file path and a page number render the embedded object’s image with external resources denied, whatever the LoadOptions of the target document allow. To show them, pass your own image data to the constructor that takes it.
  • The products of the GroupDocs.Merger.LowCode package always deny external resources.

The options are read when the Merger is created, and documents joined to it follow its options.

2. Auto-tagged PDF documents keep the format and title of the source

No API change. A PDF document saved with PdfSaveOptions.AccesibilitySettings.EnableAutoTagging set to true keeps the PDF format and the title of the source. Previously every auto-tagged document was marked as PDF/UA-1, and an untitled source got the title “Tagged PDF”. Auto-tagging adds a logical structure tree; it does not make a document PDF/UA compliant, and a source that is already marked as PDF/UA keeps its mark.

3. Fixed-layout EPUB documents — one page per book page

No API change. A fixed-layout EPUB document now has one page per book page. Previously each book page was rendered as two pages, so GetDocumentInfo reported twice the page count and page N did not match the book’s page N. Page numbers passed to page operations such as ExtractPages, RemovePages or Split now refer to the book’s pages.

4. GroupDocs.Merger.LowCode — output path and joined documents

  • JoinPdf, JoinDocx, JoinPptx and RemovePagesPdf resolve a relative output path against the current working directory. An output path given as a bare file name is now saved to the current directory; previously it was saved to Merger’s default output directory. A null or empty output path throws ArgumentNullException.
  • JoinPdf, JoinDocx and JoinPptx throw FileTypeNotSupportedException when a joined document’s extension is not the product’s format, before any output is written, for example “Input format does not match the expected format ‘PDF’; the joined file ‘a.docx’ is ‘Microsoft Word Open XML Document (.docx)’.”. Previously JoinPdf and JoinDocx produced mixed output and JoinPptx failed later with another message. A null or empty joined document path throws ArgumentNullException (“The document at index 0 is null or empty.”).
  • All seven products throw FileTypeNotSupportedException (“Input format does not match the expected format ‘PDF’; the supplied file is ‘Unknown’.”) for a source path without an extension, instead of ArgumentException.

5. Dependencies

  • The runtime packages depend on System.Security.Cryptography.Pkcs 8.0.2 (GroupDocs.Merger.Net60, GroupDocs.Merger.Net80 and their .Windows packages) or 9.0.21 (GroupDocs.Merger.Net100 and GroupDocs.Merger.Net100.Windows). GroupDocs.Merger.Net60, GroupDocs.Merger.Net60.Windows and GroupDocs.Merger.LowCode also depend on System.Formats.Asn1 8.0.2, and GroupDocs.Merger.LowCode on System.Security.Cryptography.Pkcs 8.0.2. GroupDocs.Merger.Net462 is unchanged.
  • In .NET Framework projects, the GroupDocs.Merger package no longer adds a binding redirect for System.ValueTuple to app.config or web.config (packages.config projects), and its .NET Framework build targets set DependsOnNETStandard to true unless the project sets it.

New features

  • Control of external resources: Remote images, stylesheets, linked pictures and other files a document references are no longer loaded unless you allow them. LoadOptions has new SkipExternalResources, WhitelistedResources and ExternalResourceHandler properties to allow trusted locations, allow everything for documents you trust, or decide, skip or supply each resource in your own code.
  • Concurrency fixes: EPUB documents no longer fail intermittently with NullReferenceException or IndexOutOfRangeException, and TeX documents with ArgumentException, when they are processed from several threads.
  • EPUB documents: Fixed-layout EPUB documents now have one page per book page, so page N is the book’s page N. EPUB documents whose table of contents file has another extension than .ncx no longer fail with NullReferenceException.
  • Auto-tagged PDF output: A PDF document saved with auto-tagging keeps the format and the title of the source. It is no longer marked as PDF/UA-1 unless the source was, and an untitled source no longer gets the title “Tagged PDF”.
  • .NET Framework projects: Image joins in packages.config projects no longer fail to load System.ValueTuple, and joins with SVG documents no longer fail to load netstandard on .NET Framework 4.6.2 to 4.7.0 runtimes.
  • Patched dependency: The packages depend on System.Security.Cryptography.Pkcs 8.0.2 (.NET 6.0 and .NET 8.0) or 9.0.21 (.NET 10.0), the versions that fix CVE-2026-84008 and CVE-2026-70162.
  • LowCode products: An output path given as a bare file name is saved to the current directory, and JoinPdf, JoinDocx and JoinPptx reject a joined document of another format before any output is written.

Code example

using System.Collections.Generic;
using GroupDocs.Merger;
using GroupDocs.Merger.Domain;
using GroupDocs.Merger.Domain.Options;

var loadOptions = new LoadOptions(FileType.HTML)
{
    // Load resources from one trusted folder only; everything else stays denied
    WhitelistedResources = new List<string> { "https://cdn.example.com/assets/" }
};

using (var merger = new Merger("page1.html", loadOptions))
{
    merger.Join("page2.html");
    merger.Save("merged.html");
}

using System;
using GroupDocs.Merger.Domain.Options;

public class TrustedPngHandler : IExternalResourceHandler
{
    public void OnLoading(ExternalResourceLoadingArgs args)
    {
        Uri uri;
        if (Uri.TryCreate(args.Uri, UriKind.Absolute, out uri)
            && uri.Scheme == Uri.UriSchemeHttps
            && uri.Host == "cdn.example.com"
            && uri.AbsolutePath.EndsWith(".png", StringComparison.OrdinalIgnoreCase))
        {
            args.Skipped = false;   // allow; any other resource keeps the default decision
        }
    }
}

How to get the update

NuGet

Upgrade to the latest GroupDocs.Merger package via NuGet: GroupDocs.Merger 26.10.0

dotnet add package GroupDocs.Merger --version 26.10.0

Direct download

Download assemblies from the GroupDocs.Merger for .NET 26.10 page.

Resources