MongoDB Node.js driver version 2.2.18 represents a minor update over the previous stable release, version 2.2.17, offering subtle improvements and bug fixes for developers utilizing MongoDB in their Node.js applications. Both versions share the same core dependencies, including es6-promise for asynchronous operations, and readable-stream for handling data streams efficiently. However, the key distinction lies in the updated dependency mongodb-core, which moves from version 2.1.3 to 2.1.4. This seemingly small increment in the core driver often encompasses crucial internal enhancements related to connection management, query execution, and overall stability.
Developers should particularly note that while the public API largely remains consistent, the underlying improvements in mongodb-core can lead to enhanced performance and reliability in demanding production environments. Examining the changelog for mongodb-core version 2.1.4 is advisable to understand the specific fixes and enhancements incorporated. The devDependencies sections, containing tools for development, testing, and benchmarking, remain unchanged between the two versions, indicating a focus on internal refinement rather than significant feature additions. This incremental approach assures developers that upgrading to 2.2.18 should be a straightforward process with minimal risk of introducing compatibility issues. Therefore, for users of the MongoDB Node.js driver, upgrading to version 2.2.18 is generally recommended to benefit from the latest stability and performance refinements incorporated within the core driver. The release dates indicate recent activity; hence, using one of them can be a good strategy.
All the vulnerabilities related to the version 2.2.18 of the package
Denial of Service in mongodb
Versions of mongodb prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application.
Upgrade to version 3.1.13 or later.
Deserialization of Untrusted Data in bson
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.
Deserialization of Untrusted Data in bson
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.
