MongoDB version 1.2.5 represents a minor update to the popular Node.js driver for MongoDB, building upon the stable foundation established by version 1.2.4. Both versions share identical core functionality, serving as robust interfaces for interacting with MongoDB databases. They both rely on the bson package version 0.1.5 for efficient BSON serialization and deserialization, critical for handling data exchange with the database. Likewise, their development dependencies are consistent, employing tools like dox for documentation generation, ejs for templating, step and async for asynchronous control flow, gleak for memory leak detection, github3 for GitHub interaction, markdown for documentation formatting, nodeunit for unit testing, and uglify-js for JavaScript minification. This suggests a focus on maintaining code quality and stability across both releases. However what set them appart is the release date. Version 1.2.5 released on December 12, 2012, a day after version 1.2.4. This suggests that 1.2.5 has bug fixes or very small changes relative to 1.2.4. Developers already using 1.2.4 are encouraged to migrate to 1.2.5 due to potential improvements and fixes. New adopters can safely begin with version 1.2.5.
All the vulnerabilities related to the version 1.2.5 of the package
Denial of Service in mongodb
Versions of mongodb prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application.
Upgrade to version 3.1.13 or later.
Deserialization of Untrusted Data in bson
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.
Deserialization of Untrusted Data in bson
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.
