Skip to content
OpenAdvisories

Package · npm

mariadb

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Feed

  • High 7.4
    CVE-2026-107385

    MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES

    MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, text-protocol escaping always prefixes quotes with a backslash and does not honor the session's NO_BACKSLAS…

    MariaDB mariadb-connector-nodejs sqlpad mariadb Wolfi npm
  • High 8.1
    CVE-2026-107384

    MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)

    MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4, 3.4.7, and 3.5.4, applications that enable permitSetMultiParamEntries can pass objects whose keys are expanded into a…

    MariaDB mariadb-connector-nodejs sqlpad mariadb Wolfi npm
  • High 7.5
    CVE-2026-107383

    MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters

    MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, the GeoJSON Polygon and MultiPolygon binary encoders size a Buffer.allocUnsafe() allocation from each ring'…

    MariaDB mariadb-connector-nodejs sqlpad mariadb Wolfi npm
  • Medium 5.9
    CVE-2026-107382

    MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLS

    MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.3.0 until 3.5.4, the zero-configuration TLS fingerprint-validation path calls Ed25519PasswordAuth.hash() through Authentication.validateFinge…

    MariaDB mariadb-connector-nodejs sqlpad mariadb Wolfi npm
  • Medium 6.5
    CVE-2026-55855

    MariaDB Connector/Node.js: Possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets

    MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js permits SQL injection when attacker-controlled Buffer parameters are escaped clie…

    MariaDB mariadb-connector-nodejs sqlpad mariadb Wolfi npm
  • Medium 5.9
    CVE-2026-55854

    MariaDB Connector/Node.js: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials in mariadb

    MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js can disclose an account password when PAM dialog authentication is negotiated ove…

    MariaDB mariadb-connector-nodejs sqlpad mariadb Wolfi npm
  • High 7.5
    CVE-2026-55215

    MariaDB Connector/Node.js: Connector leaks the cleartext password to an MitM despite `ssl: true`

    MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to versions 3.3.3, 3.4.6, and 3.5.3, when ssl is enabled without a pinned CA or server certificate, MariaDB Connector/Node.js sends credential…

    MariaDB mariadb-connector-nodejs sqlpad mariadb Wolfi npm