The MongoDB Node.js team is pleased to announce version 1.1.4 of the bson module!
This patch release resolves an issue with BSON serialization with invalid _bsontype, originally reported by @xiaofen9. MongoDB will be issuing a CVE for this vulnerability, and we recommend that all users pin their version of the bson module to 1.1.4 or higher.
Release Notes
Bug
- [NODE-2514] - BSON serialization ignores unknown _bsontype