# mysql2 (npm) vulnerabilities 5 known vulnerabilities (2 critical, 1 high, 2 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://www.npmjs.com/package/mysql2 ## Advisories (5) ### [CVE-2024-21512](https://cve.now/CVE-2024-21512): Versions of the package mysql2 before 3.9.8 are vulnerable to Prototype Pollution due to improper user input sanitization passed to fields… - Severity: High 8.2 - Published: May 29, 2024 - Affected: fixed in 3.9.8. ### [CVE-2024-21511](https://cve.now/CVE-2024-21511): Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone… - Severity: Critical 9.8 - Published: Apr 23, 2024 - Affected: fixed in 3.9.7. ### [CVE-2024-21508](https://cve.now/CVE-2024-21508): Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the readCodeFor function due to improper… - Severity: Critical 9.8 - Published: Apr 11, 2024 - Affected: fixed in 3.9.4. ### [CVE-2024-21507](https://cve.now/CVE-2024-21507): Versions of the package mysql2 before 3.9.3 are vulnerable to Improper Input Validation through the keyFromFields function, resulting in… - Severity: Medium 6.5 - Published: Apr 10, 2024 - Affected: fixed in 3.9.3. ### [CVE-2024-21509](https://cve.now/CVE-2024-21509): Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper… - Severity: Medium 6.5 - Published: Apr 10, 2024 - Affected: fixed in 3.9.4. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/mysql2 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.