MongoDB version 2.1.1 represents a minor update to the popular Node.js driver for MongoDB, building upon the foundation established by version 2.1.0. Both versions serve as legacy driver emulation layers atop the mongodb-core library, offering developers a familiar API for interacting with MongoDB databases. A key difference lies in the updated dependency on mongodb-core, advancing from version 1.2.26 in 2.1.0 to 1.2.28 in 2.1.1. This likely incorporates bug fixes, performance improvements, or new features within the core driver, benefiting users by enhancing the stability and efficiency of database operations. Developers relying on the mongodb driver for Node.js projects should consider upgrading to version 2.1.1 to take advantage of these under-the-hood enhancements. Beyond the core component, the dependency lists remain consistent, with shared reliance on packages like es6-promise and readable-stream for asynchronous operations and stream handling. The suite of development dependencies like co, bson, semver, bluebird used for testing and development workflows also remains the same, indicating a focus on maintaining code quality and ensuring compatibility with existing development tools. The release date difference highlights a quick turnaround, suggesting the newer version is likely addressing immediate issues found in the previous release.
All the vulnerabilities related to the version 2.1.1 of the package
Denial of Service in mongodb
Versions of mongodb prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application.
Upgrade to version 3.1.13 or later.
Deserialization of Untrusted Data in bson
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.
Deserialization of Untrusted Data in bson
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.
