MongoDB Node.js driver version 2.1.15 introduces subtle yet crucial improvements over its predecessor, version 2.1.14. Both versions serve as the official MongoDB driver for Node.js, equipping developers with the necessary tools to interact with MongoDB databases seamlessly. They share a common foundation, utilizing dependencies like es6-promise for asynchronous operation handling and readable-stream for efficient data streaming. Core functionality is underpinned by the mongodb-core module, which sees an update from version 1.3.13 to 1.3.15 in the newer release signaling enhancements in the underlying engine.
The development dependencies remain largely consistent, indicating a concentrated effort on refining existing features rather than introducing groundbreaking changes. Tools like co for generator-based control flow, nyc for code coverage, and bson for BSON serialization are consistently utilized. Developers relying on these for testing and development workflows will find a familiar landscape. The update to mongodb-core is the primary modification to note. This might encompass bug fixes, performance optimizations, or minor feature additions within the core database interaction layer.
The release date difference highlights the incremental improvements; version 2.1.15 was released roughly a week after version 2.1.14. Developers should investigate the changelog for mongodb-core version 1.3.15 to understand the specific modifications impacting their applications. While no major breaking changes seem apparent, verifying compatibility and potential performance gains related to core database operations would be beneficial for projects already employing the MongoDB Node.js driver. Overall, the update appears to be a maintenance release focused on subtle enhancements and internal improvements.
All the vulnerabilities related to the version 2.1.15 of the package
Denial of Service in mongodb
Versions of mongodb prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application.
Upgrade to version 3.1.13 or later.
Deserialization of Untrusted Data in bson
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.
Deserialization of Untrusted Data in bson
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.
