Skip to content
OpenAdvisories
High WID-SEC-2026-3838 4 CVEs

MariaDB Connector/Node.js: Mehrere Schwachstellen

Published Oct 8, 2026 · Updated Oct 8, 2026 · de-DE

Vendor: MariaDB Product: MariaDB Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in MariaDB Connector/Node.js ausnutzen, um einen Denial of Service Angriff durchzuführen, SQL-Injection-Angriffe durchzuführen, Daten offenzulegen oder zu manipulieren.

Product

MariaDB ist ein relationales Datenbanksystem, das anwendungskompatibel mit MySQL ist.

Vulnerabilities 4

  • High 8.1
    CVE-2026-107384

    MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)

    MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4, 3.4.7, and 3.5.4, applications that enable permitSetMultiParamEntries can pass objects whose keys are expanded into a…

    MariaDB mariadb-connector-nodejs sqlpad mariadb Wolfi npm
  • High 7.5
    CVE-2026-107383

    MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters

    MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, the GeoJSON Polygon and MultiPolygon binary encoders size a Buffer.allocUnsafe() allocation from each ring'…

    MariaDB mariadb-connector-nodejs sqlpad mariadb Wolfi npm
  • High 7.4
    CVE-2026-107385

    MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES

    MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, text-protocol escaping always prefixes quotes with a backslash and does not honor the session's NO_BACKSLAS…

    MariaDB mariadb-connector-nodejs sqlpad mariadb Wolfi npm
  • Medium 5.9
    CVE-2026-107382

    MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLS

    MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.3.0 until 3.5.4, the zero-configuration TLS fingerprint-validation path calls Ed25519PasswordAuth.hash() through Authentication.validateFinge…

    MariaDB mariadb-connector-nodejs sqlpad mariadb Wolfi npm

Revision history

  1. #1

    Initiale Fassung

References