MongoDB Node.js driver saw a minor version bump from 2.2.16 to 2.2.17, offering incremental refinements and, potentially, targeted bug fixes. Both versions share the same core dependencies, including es6-promise for promise handling, readable-stream for stream processing, and mongodb-core, the underlying engine for MongoDB interaction. A notable difference lies within the mongodb-core dependency, which advanced from version 2.1.2 in 2.2.16 to 2.1.3 in 2.2.17, suggesting internal improvements or fixes within the core driver functionalities. For developers, particularly those deeply invested in the MongoDB ecosystem, this update of mongodb-core represents the most pertinent change as it may contain enhancements around connection management, query execution, or data serialization routines directly impacting performance and reliability.
The devDependencies remain identical across both versions, indicating no alteration to the tooling or processes used for development, testing, or building the driver. The releaseDate difference of about 3 weeks emphasizes a relatively rapid update cycle, likely driven by targeted improvements or fixes identified in the preceding version. Developers considering migration from 2.2.16 to 2.2.17 should carefully evaluate changelogs within mongodb-core version 2.1.3 to discern specific improvements and assess their relevance to their application's requirements. The patch likely contains important bug fixes and small improvements.
All the vulnerabilities related to the version 2.2.17 of the package
Denial of Service in mongodb
Versions of mongodb prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application.
Upgrade to version 3.1.13 or later.
Deserialization of Untrusted Data in bson
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.
Deserialization of Untrusted Data in bson
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.
