MongoDB Node.js driver version 2.2.21 is a minor update from version 2.2.20, both being stable releases within the 2.2.x series. The primary difference lies in the updated dependency mongodb-core, which moves from version 2.1.5 in 2.2.20 to version 2.1.6 in 2.2.21. Developers considering upgrading should investigate the changes within mongodb-core 2.1.6 to understand its impact on their applications. These changes often include bug fixes, performance improvements, or minor feature enhancements within the core database interaction layer. The other dependencies remain the same, ensuring that the upgrade path is relatively smooth for most users.
Both versions provide a robust interface for interacting with MongoDB databases from Node.js environments. They include support for core features like connecting to databases, performing CRUD operations (Create, Read, Update, Delete), managing indexes, and utilizing advanced query options. The listed devDependencies highlight the extensive testing and quality assurance procedures employed, with tools such as eslint for code linting, nyc for code coverage, and integra for integration testing. The driver relies on asynchronous operations via es6-promise and readable-stream for efficient data handling, typical of modern Node.js applications. The dependency on bson handles the efficient serialization and deserialization of data to and from the MongoDB binary format. The MongoDB Node.js driver built by Christian Kvalheim under the Apache-2.0 license, making it suitable for a wide range of projects.
All the vulnerabilities related to the version 2.2.21 of the package
Denial of Service in mongodb
Versions of mongodb prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application.
Upgrade to version 3.1.13 or later.
Deserialization of Untrusted Data in bson
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.
Deserialization of Untrusted Data in bson
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.
