MA
Product
mariadb-connector-nodejs
7
CVEs
0
On KEV
8.1
Max CVSS
4
New 30D
Severity mix
Critical 0High 4Medium 3Low 0
Watch
Add mariadb-connector-nodejs to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-107384 | 8.1 | Oct 8 | MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries) Affected: >= 3.2.0, < 3.2.5; >= 3.3.0, < 3.3.4; >= 3.4.0, < 3.4.7; >= 3.5.0-rc.0, < 3.5.4 |
| CVE-2026-107383 | 7.5 | Oct 8 | MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters Affected: < 3.2.5; >= 3.3.0, < 3.3.4; >= 3.4.0, < 3.4.7; >= 3.5.0-rc.0, < 3.5.4 |
| CVE-2026-55215 | 7.5 | Aug 28 | MariaDB Connector/Node.js: Connector leaks the cleartext password to an MitM despite `ssl: true` Affected: < 3.2.4 |
| CVE-2026-107385 | 7.4 | Oct 8 | MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES Affected: < 3.2.5; >= 3.3.0, < 3.3.4; >= 3.4.0, < 3.4.7; >= 3.5.0-rc.0, < 3.5.4 |
| CVE-2026-55855 | 6.5 | Aug 28 | MariaDB Connector/Node.js: Possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets Affected: < 3.2.4; >= 3.3.0, < 3.3.3; >= 3.4.0, < 3.4.6; >= 3.5.0, < 3.5.3 |
| CVE-2026-107382 | 5.9 | Oct 8 | MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLS Affected: >= 3.3.0, < 3.5.4 |
| CVE-2026-55854 | 5.9 | Aug 28 | MariaDB Connector/Node.js: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials in mariadb Affected: < 3.2.4; >= 3.3.0, < 3.3.3; >= 3.4.0, < 3.4.6; >= 3.5.0, < 3.5.3 |
Showing 7