MongoDB Node.js driver version 1.1.6 offers a subtle upgrade over its predecessor, version 1.1.5, primarily reflected in its release date. While the core functionalities, dependencies (including "bson": "0.1.3"), development dependencies (such as "dox", "ejs", "step", "async", "gleak", "github3", "markdown", "nodeunit", and "uglify-js"), repository link, and author details remain identical, developers will find the updated release includes under-the-hood improvements and potential bug fixes accumulated since the previous release. The absence of significant dependency changes suggests that the update focuses on stability, performance enhancements, and addressing minor issues reported by the user community.
For developers, both versions provide a robust and widely-used driver for interacting with MongoDB databases from Node.js environments. The consistent dependency footprint across both versions implies a stable API and minimal disruption in existing projects. The "bson" dependency, essential for handling MongoDB's binary JSON format, remains unchanged, ensuring compatibility with existing data structures. The included development dependencies facilitate testing, documentation generation, and code optimization, indicating a focus on code quality and developer experience. Choosing between version 1.1.5 and 1.1.6 depends on the developer's tolerance for newer changes; opting for 1.1.6 generally recommended to benefit from the latest improvements and fixes. Both versions can be easily installed via npm using the standard npm install mongodb@<version> command.
All the vulnerabilities related to the version 1.1.6 of the package
Denial of Service in mongodb
Versions of mongodb prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application.
Upgrade to version 3.1.13 or later.
Deserialization of Untrusted Data in bson
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.
Deserialization of Untrusted Data in bson
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.
