MongoDB Node.js driver version 2.2.20 represents a minor update from the previous stable version 2.2.19, focusing primarily on internal improvements and bug fixes rather than introducing significant new features. Developers upgrading from 2.2.19 will find a familiar API surface. The key difference lies in the updated dependency on mongodb-core, which jumps from version 2.1.4 to 2.1.5. This core driver update likely includes enhancements to the underlying connection management, command execution, and potentially bug fixes related to specific MongoDB server versions.
While the package's public API remains largely consistent, this update improves stability and reliability. No changes are listed for the package's public API, the upgrade provides under-the-hood enhancements that contribute to a more robust and dependable MongoDB integration within Node.js applications. It's a worthwhile upgrade for developers seeking the latest stability improvements and bug fixes without requiring code modifications. The release date of 2.2.20 is January 11, 2017, signifying that this is a mature, well-tested release within the 2.2.x series. Developers relying on the mongodb package should update to receive all improvements and prevent the issues adressed on that release.
All the vulnerabilities related to the version 2.2.20 of the package
Denial of Service in mongodb
Versions of mongodb prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application.
Upgrade to version 3.1.13 or later.
Deserialization of Untrusted Data in bson
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.
Deserialization of Untrusted Data in bson
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.
