MongoDB Node.js driver version 1.3.10 represents a subtle but important update over its predecessor, version 1.3.9. Both versions serve as robust interfaces for Node.js applications to interact with MongoDB databases, boasting identical core dependencies like bson for efficient binary JSON serialization and kerberos for authentication (as both a required and optional dependency). Development dependencies also remain consistent, encompassing tools for documentation (dox, markdown), templating (ejs), build processes (uglify-js, optimist), testing (nodeunit, integra, gleak), asynchronous control flow (step, async), and HTTP requests (request). This common foundation indicates a focus on stability and code quality across the releases.
The key differentiator lies in the release date. Version 1.3.10 was published on June 17, 2013, a little over a week after version 1.3.9, which was released on June 6, 2013. This relatively short interval suggests that 1.3.10 likely incorporates bug fixes, minor enhancements, or security patches identified in 1.3.9. While the specific changes aren't detailed within the provided metadata, developers are advised to upgrade to the newer version to benefit from these potential improvements. The consistent dependency list implies no breaking API changes, making the upgrade straightforward. For Node.js developers using MongoDB, adopting the latest stable version (1.3.10 in this case) is generally recommended for optimal performance and reliability. Considering the rapid pace of software development, a week can be enough to fix some important bugs and security issues.
All the vulnerabilities related to the version 1.3.10 of the package
Denial of Service in mongodb
Versions of mongodb prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application.
Upgrade to version 3.1.13 or later.
Deserialization of Untrusted Data in bson
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.
Deserialization of Untrusted Data in bson
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.
