The npm package mongodb, a Node.js driver for MongoDB, saw a release of version 1.2.13 on February 22, 2013, following the previous stable version 1.2.12 released on February 13, 2013. Both versions provide essential tools for developers interacting with MongoDB databases from Node.js applications. The core functionality remains consistent, with a primary purpose of facilitating seamless data access and manipulation.
A key difference between the two versions lies in their dependencies. Version 1.2.13 updates the bson dependency to version 0.1.8, while version 1.2.12 relies on bson version 0.1.7. The bson package handles the serialization and deserialization of data to and from MongoDB's binary JSON format (BSON). This update in the bson dependency may bring performance improvements, bug fixes, or new features related to BSON handling. Developers should consult the bson package's changelog for specific details on the changes introduced in version 0.1.8.
Both versions share the same set of development dependencies, indicating that the updates between the releases primarily focused on core driver functionality rather than developer tooling enhancements. These development dependencies, including dox, ejs, step, async, gleak, github3, markdown, nodeunit, and uglify-js, are crucial for development workflows, documentation generation, testing, and code optimization.
For developers using the mongodb package, the update to version 1.2.13 is potentially important due to the updated bson dependency. While the core API and usage patterns may remain largely unchanged, evaluating the impact of the bson update on your application's data serialization and deserialization needs is recommended. Always test updates in a development environment before deploying to production to ensure compatibility and stability.
All the vulnerabilities related to the version 1.2.13 of the package
Denial of Service in mongodb
Versions of mongodb prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application.
Upgrade to version 3.1.13 or later.
Deserialization of Untrusted Data in bson
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.
Deserialization of Untrusted Data in bson
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.
