MongoDB version 2.0.49 represents a minor update to the popular Node.js driver for interacting with MongoDB databases, building upon the previous stable release, version 2.0.48. Both versions share a common foundation, providing a legacy driver emulation layer on top of mongodb-core, and are licensed under Apache-2.0, ensuring open-source usage. Developers familiar with 2.0.48 will find the upgrade to 2.0.49 seamless, as the core API remains consistent. Key dependencies like es6-promise and readable-stream are unchanged, ensuring compatibility and stable asynchronous operations. Primarily, the update introduces a bump in the mongodb-core dependency, moving from version 1.2.21 to 1.2.24. This seemingly small change likely incorporates bug fixes, performance enhancements, and potentially new functionalities within the underlying core driver.
For developers, this means potentially improved connection stability, more efficient data handling, and access to any new features offered by mongodb-core 1.2.24. Considering the shared development dependencies for testing and tooling, like co, bson, gleak, jsdoc, rimraf, semver, integra, bluebird, optimist, mongodb-tools, and mongodb-version-manager are identical, the update likely focuses on internal improvements rather than breaking API changes. Users should consult the mongodb-core changelog for a detailed breakdown of changes incorporated into the 1.2.24 release to fully leverage the benefits of this upgrade. Released on November 20, 2015, it comes just a few weeks after the previous version.
All the vulnerabilities related to the version 2.0.49 of the package
Denial of Service in mongodb
Versions of mongodb prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application.
Upgrade to version 3.1.13 or later.
Deserialization of Untrusted Data in bson
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.
Deserialization of Untrusted Data in bson
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.
