- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 7 · 4 high, 3 medium
- Weekly downloads
- 1.1M
- Dependents
- 366
- Registry
- npm
Advisories 7
- CVE-2026-107385High 7.4
MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES
Affected: fixed in 3.2.5; from 3.3.0, fixed in 3.3.4; from 3.4.0, fixed in 3.4.7; from 3.5.0-rc.0, fixed in 3.5.4.
- CVE-2026-107384High 8.1
MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)
Affected: from 3.2.0, fixed in 3.2.5; from 3.3.0, fixed in 3.3.4; from 3.4.0, fixed in 3.4.7; from 3.5.0-rc.0, fixed in 3.5.4.
- CVE-2026-107383High 7.5
MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters
Affected: fixed in 3.2.5; from 3.3.0, fixed in 3.3.4; from 3.4.0, fixed in 3.4.7; from 3.5.0-rc.0, fixed in 3.5.4.
- CVE-2026-107382Medium 5.9
MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLS
Affected: from 3.3.0, fixed in 3.5.4.
- CVE-2026-55855Medium 6.5
MariaDB Connector/Node.js: Possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets
Affected: fixed in 3.2.4; from 3.3.0, fixed in 3.3.4; from 3.4.0, fixed in 3.4.6; from 3.5.0, fixed in 3.5.3.
- CVE-2026-55854Medium 5.9
MariaDB Connector/Node.js: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials in mariadb
Affected: fixed in 3.2.4; from 3.3.0, fixed in 3.3.3; from 3.4.0, fixed in 3.4.6; from 3.5.0, fixed in 3.5.3.
- CVE-2026-55215High 7.5
MariaDB Connector/Node.js: Connector leaks the cleartext password to an MitM despite `ssl: true`
Affected: fixed in 3.2.4; from 3.3.0, fixed in 3.3.3; from 3.4.0, fixed in 3.4.6; from 3.5.0, fixed in 3.5.3.