The npm package mysql version 2.7.0 represents a minor update from the previous stable version, 2.6.2, within the MySQL driver for Node.js ecosystem. Both versions are described as fully JavaScript implementations, requiring no compilation, distributed under the MIT license, ensuring they are accessible and easily integrated into diverse projects. At its core, the package offers a robust MySQL client implementation for Node.js.
Examining the metadata, the core dependencies remain unchanged between versions. Both rely on bignumber.js (version 2.0.7) for handling large numbers, readable-stream (version ~1.1.13) for stream processing, and require-all (version ~1.0.0) for simplified module loading. Similarly, the development dependencies are the same: istanbul for code coverage, rimraf for recursive file deletion, mkdirp for creating directories, urun and utest for testing functionalities. This suggests the update primarily focuses on internal improvements and bug fixes rather than a fundamental restructuring of the library or introduction of new features.
The crucial distinction lies in the releaseDate. Version 2.7.0 was released on May 28, 2015, whereas 2.6.2 was released on April 15, 2015. This temporal separation indicates that version 2.7.0 likely incorporates enhancements or patches addressing issues identified in the prior version, 2.6.2. For developers using the mysql package, upgrading to 2.7.0 is advisable to benefit from the latest stability improvements and potential bug resolutions. When considering these versions, developers should consult the changelog or release notes (if available) within the project's GitHub repository to gain a more detailed understanding of the specific refinements implemented between these two stable releases.
All the vulnerabilities related to the version 2.7.0 of the package
mysql Node.JS Module Vulnerable to Remote Memory Exposure
Versions of mysql before 2.14.0 are vulnerable to remove memory exposure.
Affected versions of mysql package allocate and send an uninitialized memory over the network when a number is provided as a password.
Only mysql running on Node.js versions below 6.0.0 are affected due to a throw added in newer node.js versions.
Proof of Concept:
require('mysql').createConnection({
host: 'localhost',
user: 'user',
password : USERPROVIDEDINPUT, // number
database : 'my_db'
}).connect();
Update to version 2.14.0 or later.