MongoDB Node.js driver version 2.2.24 represents a minor update over its predecessor, version 2.2.23, primarily focusing on improvements and bug fixes rather than introducing major new features. Both versions share the same core dependencies: es6-promise, mongodb-core, and readable-stream, ensuring fundamental compatibility and functionality remain consistent. Similarly, the development dependencies, encompassing tools for testing, linting, documentation, and benchmarking, are largely identical, suggesting a focus on maintaining code quality and development workflow.
The most notable difference lies in the bson dependency within the devDependencies. Version 2.2.24 utilizes the "latest" tag for bson, while version 2.2.23 specifically depends on version "1.0.0". This indicates that version 2.2.24 integrates the newest available version of the BSON parser during its development cycle. BSON (Binary JSON) is crucial for efficient data serialization and deserialization between the MongoDB database and the Node.js application. Using the "latest" version during development potentially incorporates performance enhancements, bug fixes, or new features related to BSON handling. However, it's important to note that this difference only affects the development environment and doesn't directly impact the runtime behavior of applications using the driver.
Both version were released in February 2017, with version 2.2.24 being released one day after. Choosing between these versions depends on the specific needs and risk assessment of the developer. If staying current with the latest BSON enhancements is a priority (during development), version 2.2.24 might be preferred. However, for maximum stability and predictability, especially in production environments, version 2.2.23, with its explicitly defined bson version, offers a more conservative approach.
All the vulnerabilities related to the version 2.2.24 of the package
Denial of Service in mongodb
Versions of mongodb prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application.
Upgrade to version 3.1.13 or later.
Deserialization of Untrusted Data in bson
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.
Deserialization of Untrusted Data in bson
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.
