CVE-2026-107385 · GHSA-r3rv-jm3r-62q2
MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES
- Risk score
- 67/100
- CVSS
- 7.4 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 8 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, text-protocol escaping always prefixes quotes with a backslash and does not honor the session's NO_BACKSLASH_ESCAPES mode, including in Connection.escape(). When that …
- Affected
- mariadb (npm) < 3.2.5; mariadb (npm) >= 3.3.0, < 3.3.4; mariadb (npm) >= 3.4.0, < 3.4.7; mariadb (npm) >= 3.5.0-rc.0, < 3.5.4
- Fix
- Upgrade mariadb to 3.2.5 or 3.3.4 or 3.4.7 or 3.5.4 (whichever matches your release line) or later.
- Exploitation
- No known exploitation
Story map
At a glance
mariadb: Amber, patch this week. MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4, 3.4.7, and 3.5.4, applications that enable permitSetMultiParamEntries can pass objects whose keys are expanded into a SQL SET clause without being processed by escapeId. An atta…
The flaws
- CVE-2026-107385: MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES (CVSS 7.4 · EPSS 0%)
- CVE-2026-107384: MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries) (CVSS 8.1 · EPSS 0%)
- CVE-2026-107383: MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters (CVSS 7.5 · EPSS 0%)
- CVE-2026-107382: MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLS (CVSS 5.9 · EPSS 0%)
The fix
Upgrade mariadb: 3.2.5 · 3.3.4 · 3.4.7 · 3.5.4 or later on your release line
Who is exposed: mariadb (npm) >= 3.2.0, < 3.2.5; mariadb (npm) >= 3.3.0, < 3.3.4; mariadb (npm) >= 3.4.0, < 3.4.7; mariadb (npm) >= 3.5.0-rc.0, < 3.5.4
Where it stands
- No known exploitation
Connects to
- Same weakness: SQL injection (CWE-89). 398 other warnings in 30 days
Why it is Amber
- CVSS 7.4 high
- Remotely exploitable without logging in
- On your watchlist: node.js, npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| mariadb | npm | < 3.2.5 | 3.2.5 |
| mariadb | npm | >= 3.3.0, < 3.3.4 | 3.3.4 |
| mariadb | npm | >= 3.4.0, < 3.4.7 | 3.4.7 |
| mariadb | npm | >= 3.5.0-rc.0, < 3.5.4 | 3.5.4 |
References
- https://github.com/advisories/GHSA-r3rv-jm3r-62q2
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/security/advisories/GHSA-r3rv-jm3r-62q2
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/6995c8cf8e51b2ad055de63dcaa4094eebbef5ce
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/7670d90949307e735c0ae148d80b3776478a599d
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/95886df9fa0cca991e2be339caa6c3979be61553
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/e5a9d732d9574177749488336319b73074072779
- https://hackerone.com/reports/3889197
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.2.5
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.3.4
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.4.7
Original description
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, text-protocol escaping always prefixes quotes with a backslash and does not honor the session's NO_BACKSLASH_ESCAPES mode, including in Connection.escape(). When that mode is enabled, the backslash is an ordinary character, so an attacker-controlled placeholder value can close the SQL string literal and inject arbitrary SQL with the application's database privileges. The vulnerable configuration may be enabled server-wide, through connector initialization options, or with an application-issued SET sql_mode; execute() and batch() use binary protocols and are not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.
Last activity 8 Oct 2026. Patch Forecast updates every hour.