Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
6 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
When escaping string and binary parameters for the text protocol, the connector always escaped the quote character with a backslash, without ever consulting the session's NOBACKSLASHESCAPES SQL mode. The server status flag was declared (STATUSNOBACKSLASHESCAPES) but never read. Under a server or session running with NOBACKSLASHESCAPES, the backslash is an ordinary character and the quote must be escaped by doubling it. The escaped value produced by the connector therefore closed the string literal, and a value passed through a placeholder was interpreted as SQL. All text-protocol escaping entry points were affected, including Connection.escape(). Impact An attacker able to influence any value the application passes as a query parameter could execute arbitrary SQL with the privileges of the application's database user: read, modify or delete any data reachable by that connection. Exposure requires a deployment where NOBACKSLASHESCAPES is enabled — server-wide, through the…
Recommended action: Upgrade to 3.5.4, 3.4.7, 3.3.4 or 3.2.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
With the non-default permitSetMultiParamEntries option enabled, an object passed as a query parameter is expanded into a SET clause, each key becoming a column name. The three code paths implementing that expansion built the backtick-quoted identifier by hand and wrote the key out unescaped, while only the value was escaped. A key containing a backtick therefore closed the identifier, and the remainder of the key was parsed as SQL. The connector's own identifier escaper (escapeId, which correctly doubles backticks) existed but was not called from any of the three sites. This is an incomplete fix of GitHub issue #252, which corrected escapeId itself in 2023 but left these hand-built call sites unchanged. Impact An application that enables permitSetMultiParamEntries and passes an object with attacker-influenced keys into a statement such as conn.query('UPDATE users SET ? WHERE id = ?', [body, id]) allows the caller to write columns the application never intended to expose —…
Recommended action: Upgrade to 3.5.4, 3.4.7, 3.3.4 or 3.2.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When encoding a GeoJSON Polygon or MultiPolygon parameter for the binary protocol, the connector sized its output buffer from the length property of each ring, then wrote each ring only if it was a real array. The two loops disagreed: any non-array ring carrying a numeric length (a string, or an object such as {"length": 4000}) still reserved 4 + 16 length bytes, but wrote none of them. The buffer came from Buffer.allocUnsafe() and was returned in full regardless of how far the write position had advanced, so every reserved-but-unwritten byte was uninitialized Node.js heap. The sibling LineString case handled this correctly, aborting with null on the first malformed point, so no reserved byte could escape unwritten. The only gate on this path is value.type naming a GeoJSON type, so any object shaped like {"type": "Polygon", ...} reached the encoder. Impact An application that passes an attacker-influenced object as a parameter to execute() or batch() writes uninitialized…
Recommended action: Upgrade to 3.5.4, 3.4.7, 3.3.4 or 3.2.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
On the zero-configuration TLS path, the connector accepts a self-signed server certificate at the TLS level and then validates the server's identity from the fingerprint hash the server appends to the final OKPacket (Authentication.validateFingerPrint). That validation calls hash() on the authentication plugin in use to obtain the password-derived secret both sides combine with the seed and the certificate fingerprint. Ed25519PasswordAuth.hash() referenced an identifier seed that was not in scope: it was neither a parameter of the method nor a module-scope binding, existing only as a parameter of the unrelated static encryptPassword(password, seed). Invoking the method therefore threw ReferenceError: seed is not defined. The throw happens synchronously inside the socket data handler, and no frame between PacketInputStream.onData() and the plugin guards it, so the error escapes as an uncaught exception rather than surfacing as a connection error. Because the fingerprint…
Recommended action: Upgrade to 3.5.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When PAM (dialog) authentication is used, the connector can be coerced into sending the account password in cleartext over an insecure connection. A hostile or man-in-the-middle server can trigger this with the default configuration, disclosing the user's password. Details The mysqlclearpassword plugin is gated behind a secure connection: the driver refuses to transmit the password in cleartext over plain TCP. The sibling PAM plugin handler (SendPamAuthPacketFactory, server-side plugin name dialog) did not override that gate and inherited the default value false, so it was not subject to the same secure-transport requirement. As a result, a hostile or man-in-the-middle server can issue an Authentication Switch Request for the dialog plugin over plain TCP, and the driver responds with the user's password in cleartext. With the default configuration (sslMode=DISABLE, restrictedAuth=null) this is reachable with no non-default options. Am I affected? You are affected if all of…
Recommended action: Upgrade to 3.5.3, 3.4.6, 3.3.3 or 3.2.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When SSL/TLS is enabled but no CA / server certificate is provided, the connector verifies the server's identity using fingerprint validation. The check is effective, the connection is ultimately rejected when it fails, but it happens after the authentication exchange. As a result, the credentials are sent before validation occurs, so an active man-in-the-middle who presents their own certificate receives the password in the handshake before the connection is aborted. Impact The credentials are transmitted to the peer before the server's identity is validated. An on-path attacker (MitM) presenting any certificate can capture the account password, even though the connection then fails the fingerprint check and is closed. The disclosed credentials can subsequently be used to authenticate directly against the server. - Attacker requirement: active man-in-the-middle position on the network path - Affected configuration: SSL/TLS enabled without a CA / server certificate Affected…
Recommended action: Upgrade to 3.5.3, 3.4.6, 3.3.3 or 3.2.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.