MongoDB's node.js driver saw a release of version 1.2.0 on November 27, 2012, following version 1.1.11 which was released on October 10, 2012. Both versions share the same core dependency: bson version 0.1.5, essential for handling MongoDB's binary JSON format. Their development dependencies are identical, including tools for documentation (dox), templating (ejs), asynchronous control flow (step, async), memory leak detection (gleak), GitHub interaction (github3), markdown processing, unit testing (nodeunit), and JavaScript minification (uglify-js). This suggests a consistent development and testing environment was maintained between the two releases.
The primary difference lies in the version number, indicating potential bug fixes, performance improvements, or new features introduced in 1.2.0. Developers upgrading should consult the changelog for detailed information on these changes as they aren't explicitly stated in package metadata. Both versions point to the same git repository on GitHub, highlighting the project's commitment to open-source development. Christian Amor Kvalheim remains the listed author for both versions, guaranteeing stability and clear communications with the team working on the package. The "dist" attribute provides the location of the tarball for each version. Thus, npm install mongodb@1.2.0 or npm install mongodb@1.1.11 will retrieve the correct version of the driver. Upgrade when the differences are interesting for you.
All the vulnerabilities related to the version 1.2.0 of the package
Denial of Service in mongodb
Versions of mongodb prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application.
Upgrade to version 3.1.13 or later.
Deserialization of Untrusted Data in bson
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.
Deserialization of Untrusted Data in bson
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.
