MongoDB version 1.2.1 represents a minor update to the 1.2.0 release of the popular Node.js driver for MongoDB, a crucial component for developers building applications that interact with MongoDB databases. Both versions share a common foundation, providing essential tools for connecting to, querying, and manipulating data within MongoDB. They both relies on bson version 0.1.5. Similarly, the development dependencies, including tools for documentation (dox, markdown), templating (ejs), asynchronous control flow (step, async), memory leak detection (gleak), GitHub interaction (github3), unit testing (nodeunit), and code minification (uglify-js), remain consistent between the two versions. The core functionality and API exposed to developers likely remain unchanged.
The key difference lies in the release date: version 1.2.1 was published on November 30, 2012, a few days after version 1.2.0, which was released on November 27, 2012. This suggests that version 1.2.1 likely includes bug fixes or very minor improvements addressing immediate issues found in the preceding version. Developers already using 1.2.0 should consider upgrading to 1.2.1 to benefit from these potential fixes; however, the small time difference and consistent dependency list suggest that the update is unlikely to introduce breaking changes or new features. Existing code should, in principle, work seamlessly with the newer point release. Before upgrading, check community posts to see if there were any outstanding bugs found in version 1.2.0.
All the vulnerabilities related to the version 1.2.1 of the package
Denial of Service in mongodb
Versions of mongodb prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application.
Upgrade to version 3.1.13 or later.
Deserialization of Untrusted Data in bson
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.
Deserialization of Untrusted Data in bson
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.
