MongoDB Node.js driver version 1.2.2 represents a minor update over its predecessor, version 1.2.1, both iterations serving as crucial tools for Node.js developers interacting with MongoDB databases. Examining the package data, the core dependencies remain consistent, with both versions relying on bson version 0.1.5 for Binary JSON serialization. Similarly, the development dependencies – encompassing tools like dox, ejs, step, async, gleak, github3, markdown, nodeunit, and uglify-js – are identical, suggesting a focus on stability and consistent tooling. The repository information and author details are also unchanged, indicating continuity in development and maintenance.
The primary distinction lies in the version number itself (1.2.2 vs. 1.2.1) and the release date. Version 1.2.2 was released on December 3, 2012, succeeding version 1.2.1, which was released on November 30, 2012. This short interval between releases typically signifies bug fixes, minor enhancements, or dependency updates that didn't warrant a major or even a minor version bump in the semantic versioning scheme. Developers considering migrating from 1.2.1 to 1.2.2 should anticipate improved stability or resolution of edge-case issues, without introducing breaking changes. The tarball URLs point towards the specific distribution files for each version on the npm registry, allowing direct access for installation. For users encountering problems in 1.2.1, upgrading to 1.2.2 is a reasonable step. While both versions are dated, understanding the context and potential bug fixes offers value to legacy project maintainers.
All the vulnerabilities related to the version 1.2.2 of the package
Denial of Service in mongodb
Versions of mongodb prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application.
Upgrade to version 3.1.13 or later.
Deserialization of Untrusted Data in bson
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.
Deserialization of Untrusted Data in bson
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.
