The mongodb npm package, a crucial driver for connecting Node.js applications to MongoDB databases, saw a minor version bump from 1.2.3 to 1.2.4 in December 2012. While the core functionality remained consistent, as indicated by the identical dependencies on bson 0.1.5, the update likely included bug fixes and minor improvements. Developers already using version 1.2.3 would find the upgrade a low-risk path to increased stability.
Both versions share the same development dependencies, including tools like dox for documentation generation, ejs for templating, step and async for asynchronous control flow, gleak for memory leak detection, github3 for GitHub interaction, markdown for, well, markdown processing, nodeunit for unit testing, and uglify-js for JavaScript minification. This suggests a consistent development and testing approach maintained by Christian Amor Kvalheim, the package author. The repository URL points to the node-mongodb-native project on GitHub, allowing developers to inspect the source code and contribute.
The key difference lies in the release dates. Version 1.2.3 was released on December 10th, 2012, while 1.2.4 followed a day later on December 11th, indicating a quick patch or refinement after the initial release. Developers should always prioritize the latest stable version for optimal performance and security, making 1.2.4 the better choice in this specific scenario for new projects adopting the mongodb driver.
All the vulnerabilities related to the version 1.2.4 of the package
Denial of Service in mongodb
Versions of mongodb prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application.
Upgrade to version 3.1.13 or later.
Deserialization of Untrusted Data in bson
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.
Deserialization of Untrusted Data in bson
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.
