`BinaryFormatter` is an insecure serializer built into the .net framework, that's disabled by default in ASP.NET web apps since .NET 5.0. Microsoft advises against its use and is in the process of removing it. It serializes fields regardless of their visibility into an unspecified binary format. It supports polymorphism and cyclic object graphs.