Version 1.1.0 of the popular mongodb Node.js driver introduces several key updates compared to its previous stable version, 1.0.2. Primarily, developers will notice an upgrade in the bson dependency, moving from version 0.0.6 to 0.1.0. This likely brings performance improvements and feature enhancements related to Binary JSON serialization, a crucial aspect of interacting efficiently with MongoDB databases. Furthermore, version 1.1.0 introduces the async dependency at version 0.1.22, suggesting potential changes in asynchronous operation handling within the driver, possibly offering more robust and flexible control over concurrent tasks. It's important to note that the previous version, 1.0.2, did not declare it as a dependency explicitly.
The release date also provides a temporal context; version 1.1.0 arrived in July 2012, a few months after version 1.0.2's release in May. While the core description of the package remains consistent – a Node.js driver for MongoDB – these dependency updates signal internal improvements, warranting a closer look for developers aiming to leverage the latest optimizations. The update also transitioned the repository URL from a git:// protocol to http://. Developers should consult the changelog or release notes (if available) for a comprehensive understanding of all modifications, bug fixes, and new features incorporated in version 1.1.0. These changes contribute to more reliable and performant interactions with MongoDB databases.
All the vulnerabilities related to the version 1.1.0 of the package
Denial of Service in mongodb
Versions of mongodb prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application.
Upgrade to version 3.1.13 or later.
Deserialization of Untrusted Data in bson
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.
Deserialization of Untrusted Data in bson
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.
