The npm package mongodb, a crucial tool for Node.js developers interacting with MongoDB databases, saw a release of version 2.2.26 following the 2.2.25 version. Both versions share the same core functionality: providing an official and robust driver for connecting Node.js applications to MongoDB. They are offered under the Apache-2.0 license.
The primary difference between versions 2.2.25 and 2.2.26 lies in their dependencies. The newer version includes an update to mongodb-core, moving from version 2.1.9 to 2.1.10. It also has an upgrade in readable-stream from 2.1.5 to 2.2.7. These under-the-hood changes, while seemingly small, often address critical bug fixes, performance improvements, and enhanced stability within the core MongoDB interaction layer. Developers incorporating mongodb into their projects should consider these updates when deciding on a version, especially if encountering issues related to database connectivity or stream handling. The newer release date also means that developers will benefit from the most up-to-date security patches.
While the devDependencies, including tools like eslint, nyc, and bson, stay consistent, reflecting a stable development environment, the underlying dependency updates in the core packages of 'mongodb' are most significant for developers aiming for optimal performance and reliability in their MongoDB-powered applications. Always check the changelog of updated packages to see if the fixes affect your usecase.
All the vulnerabilities related to the version 2.2.26 of the package
Denial of Service in mongodb
Versions of mongodb prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application.
Upgrade to version 3.1.13 or later.
Deserialization of Untrusted Data in bson
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.
Deserialization of Untrusted Data in bson
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.
