Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
7 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A rogue MySQL server (or MITM) can force mysql2 to send credentials in plaintext by requesting an auth switch to mysqlclearpassword. The driver complies without verifying that TLS is active. Details mysqlclearpassword is registered as a default standard plugin in lib/commands/authswitch.js (line 21). When a server sends an AuthSwitchRequest (0xFE) requesting mysqlclearpassword, the driver executes it without checking for TLS. The plugin (lib/authplugins/mysqlclearpassword.js) returns Buffer.from(password + '\0'). Note: cachingsha2password plugin DOES check for SSL before sending cleartext (line 77). But mysqlclearpassword has no such guard. Attack Scenario 1. Attacker operates rogue MySQL server or performs MITM 2. Server advertises cachingsha2password in handshake 3. Client sends hashed auth response 4. Server replies with AuthSwitchRequest to mysqlclearpassword 5. Client sends password in plaintext 6. Attacker captures plaintext password PoC Rogue MySQL server (Node.js, ~80…
Recommended action: Upgrade to 3.22.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vulnerability Details File: lib/compressedprotocol.js Line: 43 (zlib.inflate(body, (err, data) = { ... }) inside handleCompressedPacket) Root Cause When a connection is created with compress: true (and the server advertises CLIENTCOMPRESS), every incoming packet is unwrapped by handleCompressedPacket() in lib/compressedprotocol.js, which calls: No options object (in particular, no maxOutputLength) is passed. Node's zlib convenience methods default maxOutputLength to buffer.kMaxLength, which on this platform is Number.MAXSAFEINTEGER — i.e. effectively unbounded until the process runs out of memory. The 3-byte "length of payload before compression" field in the compressed-packet header is read (packet.readInt24()) but is only used to branch on !== 0; it is never used to cap or validate the actual inflate output size, and the real decompressed size is determined purely by the attacker-supplied deflate stream. Because DEFLATE can reach compression ratios over 1000:1 for crafted…
Recommended action: Upgrade to 3.23.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Versions of the package mysql2 before 3.9.8 are vulnerable to Prototype Pollution due to improper user input sanitization passed to fields and tables when using nestTables.
Recommended action: Upgrade to 3.9.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function.
Recommended action: Upgrade to 3.9.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the readCodeFor function due to improper validation of the supportBigNumbers and bigNumberStrings values.
Recommended action: Upgrade to 3.9.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through parserFn in textparser.js and binaryparser.js.
Recommended action: Upgrade to 3.9.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Versions of the package mysql2 before 3.9.3 are vulnerable to Improper Input Validation through the keyFromFields function, resulting in cache poisoning. An attacker can inject a colon : character within a value of the attacker-crafted key.
Recommended action: Upgrade to 3.9.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.