MongoDB Node.js driver version 1.1.8 represents a subtle but potentially important update over its predecessor, version 1.1.7. Both versions serve as drivers facilitating interaction between Node.js applications and MongoDB databases. Key functionality remains consistent between the two, providing developers options to connect, query, and manipulate data within MongoDB. The primary difference lies in the updated dependency on the bson library. Version 1.1.8 utilizes bson version 0.1.4, while the older 1.1.7 relies on bson 0.1.3. BSON (Binary JSON) handles the serialization of Javascript objects into a binary format for efficient storage and transmission of data within MongoDB. This implies that the newer version includes potential improvements or bug fixes within the BSON serialization/deserialization process and these may impact data integrity and performance.
The development dependencies, including tools for documentation (dox, markdown), templating (ejs), asynchronous control flow (step, async), memory leak detection (gleak), GitHub interaction (github3), unit testing (nodeunit), and JavaScript minification (uglify-js), remain unchanged between the two versions. This suggests that the core purpose of the 1.1.8 release was to update an existing dependency or fix bugs instead of changing the developer experience.
Developers considering upgrading from 1.1.7 to 1.1.8 should evaluate the specific changes made within the bson 0.1.4 release relative to 0.1.3. Any performance improvement, increased stability, or bug fix could motivate an upgrade.
All the vulnerabilities related to the version 1.1.8 of the package
Denial of Service in mongodb
Versions of mongodb prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application.
Upgrade to version 3.1.13 or later.
Deserialization of Untrusted Data in bson
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.
Deserialization of Untrusted Data in bson
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.
