MongoDB Node.js driver version 1.3.6 and 1.3.5 offer developers tools to interact with MongoDB databases from Node.js applications. Examining the differences between these versions reveals minor yet potentially important updates. Both versions share the same core purpose and common development dependencies such as dox, ejs, step, async, gleak, integra, request, markdown, nodeunit, optimist, and uglify-js for tasks like documentation generation, templating, asynchronous control flow, memory leak detection, integration testing, HTTP requests, markdown processing, unit testing, command-line argument parsing, and JavaScript code minification. They also rely on kerberos as an optional dependency potentially useful for authentication.
However, version 1.3.6 boasts a subtle but significant difference in its dependencies. It declares a dependency on bson version 0.1.9, a library for working with Binary JSON (BSON) used by MongoDB, while version 1.3.5 depends on bson version 0.1.8. This update might include bug fixes, performance improvements, or new features in bson relevant to interacting with MongoDB. This difference in direct dependency could impact the way data is serialized and deserialized. The release dates also indicate slightly over a week separating the two versions, with 1.3.6 being released on May 27, 2013, and 1.3.5 being released on May 16, 2013, pointing to a short period of development or bug fixing between the releases. Developers should evaluate the bson changelog when upgrading to 1.3.6 to be aware of potential compatibility considerations given that bson is important when transforming the format of the data.
All the vulnerabilities related to the version 1.3.6 of the package
Denial of Service in mongodb
Versions of mongodb prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application.
Upgrade to version 3.1.13 or later.
Deserialization of Untrusted Data in bson
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.
Deserialization of Untrusted Data in bson
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.
