Cleartext transmission of sensitive information in mariadb-connector-nodejs
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-319.
Summary
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js can disclose an account password when PAM dialog authentication is negotiated over an insecure transport. In lib/cmd/handshake/auth/pam-password-auth.js and lib/cmd/handshake/authentication.js, the SendPamAuthPacketFactory behavior for the server-side plugin dialog lacked the secure-transport gate applied to mysql_clear_password. With the default sslMode=DISABLE and restrictedAuth=null settings, a hostile or on-path server can send an Authentication Switch Request for dialog over plain TCP, causing the connector to return the account password in cleartext. Properly verified TLS and a local Unix socket prevent this path, while fingerprint-only server identity validation is not sufficient. This issue is fixed in versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MariaDB | mariadb-connector-nodejs | before 3.2.4; 3.3.0 to before 3.3.3; 3.4.0 to before 3.4.6; 3.5.0 to before 3.5.3 | 3.2.4, 3.3.3, 3.4.6, 3.5.3 | Patch available | CNA |
| — | mariadb (npm) | before 3.2.4 | 3.2.4 | Patch available | GHSA-42r5-vhpq-m858 |
| — | mariadb (npm) | 3.3.0 to before 3.3.3 | 3.3.3 | Patch available | GHSA-42r5-vhpq-m858 |
| — | mariadb (npm) | 3.4.0 to before 3.4.6 | 3.4.6 | Patch available | GHSA-42r5-vhpq-m858 |
| — | mariadb (npm) | 3.5.0 to before 3.5.3 | 3.5.3 | Patch available | GHSA-42r5-vhpq-m858 |
- mariadb-connector-nodejs VendorMariaDB Affected before 3.2.4; 3.3.0 to before 3.3.3; 3.4.0 to before 3.4.6; 3.5.0 to before 3.5.3 Fixed in 3.2.4, 3.3.3, 3.4.6, 3.5.3 Patch available CNA
- mariadb (npm) Vendor— Affected before 3.2.4 Fixed in 3.2.4 Patch available GHSA-42r5-vhpq-m858
- mariadb (npm) Vendor— Affected 3.3.0 to before 3.3.3 Fixed in 3.3.3 Patch available GHSA-42r5-vhpq-m858
- mariadb (npm) Vendor— Affected 3.4.0 to before 3.4.6 Fixed in 3.4.6 Patch available GHSA-42r5-vhpq-m858
- mariadb (npm) Vendor— Affected 3.5.0 to before 3.5.3 Fixed in 3.5.3 Patch available GHSA-42r5-vhpq-m858
Remediation
- Fix · CNA mariadb-connector-nodejs (mariadb-corporation) Fixed in 3.2.4, 3.3.3, 3.4.6, 3.5.3
- Fix · GHSA-42r5-vhpq-m858 mariadb (npm) Fixed in 3.2.4 Advisory →
- Fix · GHSA-42r5-vhpq-m858 mariadb (npm) Fixed in 3.3.3 Advisory →
- Fix · GHSA-42r5-vhpq-m858 mariadb (npm) Fixed in 3.4.6 Advisory →
- Fix · GHSA-42r5-vhpq-m858 mariadb (npm) Fixed in 3.5.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-55854
- 2026-10-03 Alias added: GHSA-42r5-vhpq-m858
References
Other 11
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/security/advisories/GHSA-42r5-vhpq-m858
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/29733403cfe6519cdfe9c36c93765a468fbe285d
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/53b304264df84496d331dba2765c3634602f342e
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/9781de636841d34afdd08d81dd07d43edb82f85c
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/fbc159c2c8bd18c2db2d2e6587ab3020bbda64b6
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.2.4
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.3.3
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.4.6
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.5.3
- https://jira.mariadb.org/browse/CONJS-353
- https://github.com/mariadb-corporation/mariadb-connector-nodejs
More MariaDB vulnerabilities
- TI-2023-11776 MariaDB v10.5 was discovered to contain a remote code execution (RCE) vulnerability via… CVSS 3.1CRITICAL 9.8
- TI-2016-05707 Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB… CVSS 3.0CRITICAL 9.8
- TI-2022-00687 Infinite loop in BN_mod_sqrt() reachable when parsing certificates CVSS 3.1HIGH 7.5
- TI-2014-00217 OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly… CVSS 3.1HIGH 7.4
- TI-2014-00188 The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0… CVSS 2.0MEDIUM 6.8
- TI-2018-15259 zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if… CVSS 3.1HIGH 7.5
Sources
- CVE-2026-55854 · CVE Program
- CVE-2026-55854 · NVD
- FIRST EPSS
- GHSA-42r5-vhpq-m858 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences