Read the docs
TI-2026-69680 Aliases CVE-2026-107383GHSA-48qf-xh34-q73r

Uninitialized memory exposed by MariaDB Connector/Node.js GeoJSON

Priority LOW 39CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Affected are MariaDB Connector/Node.js versions before 3.2.5, from 3.3.0 before 3.3.4, from 3.4.0 before 3.4.7, and from 3.5.0-rc.0 before 3.5.4. The GeoJSON Polygon and MultiPolygon binary encoders allocate an uninitialized buffer from each ring's numeric length before checking that the ring is an array (CWE-200). An attacker who can supply malformed GeoJSON parameters can store uninitialized Node.js heap data in a database value, which may include credentials or TLS key material.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, the GeoJSON Polygon and MultiPolygon binary encoders size a Buffer.allocUnsafe() allocation from each ring's numeric length before confirming that the ring is an array. A malformed non-array ring can therefore reserve bytes that the writing loop skips, and the connector sends the full buffer through execute() or batch(), disclosing uninitialized Node.js heap data into a database value. The persisted data can include other users' content, session material, database credentials, or TLS key material and may propagate to backups and replicas. The text-protocol query() path is not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00388 33rd percentileScored 2026-11-07
Fix Fixed mariadb-connector-nodejs (mariadb-corporation): 3.2.5, 3.3.4, 3.4.7 +1mariadb (npm): 3.2.5, 3.3.4, 3.4.7 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MariaDBmariadb-connector-nodejsbefore 3.2.5; 3.3.0 to before 3.3.4; 3.4.0 to before 3.4.7; 3.5.0-rc.0 to before 3.5.43.2.5, 3.3.4, 3.4.7, 3.5.4Patch availableCNA
—mariadb (npm)before 3.2.53.2.5Patch availableGHSA-48qf-xh34-q73r
—mariadb (npm)3.3.0 to before 3.3.43.3.4Patch availableGHSA-48qf-xh34-q73r
—mariadb (npm)3.4.0 to before 3.4.73.4.7Patch availableGHSA-48qf-xh34-q73r
—mariadb (npm)3.5.0-rc.0 to before 3.5.43.5.4Patch availableGHSA-48qf-xh34-q73r
  • mariadb-connector-nodejs VendorMariaDB Affected before 3.2.5; 3.3.0 to before 3.3.4; 3.4.0 to before 3.4.7; 3.5.0-rc.0 to before 3.5.4 Fixed in 3.2.5, 3.3.4, 3.4.7, 3.5.4 Patch available CNA
  • mariadb (npm) Vendor— Affected before 3.2.5 Fixed in 3.2.5 Patch available GHSA-48qf-xh34-q73r
  • mariadb (npm) Vendor— Affected 3.3.0 to before 3.3.4 Fixed in 3.3.4 Patch available GHSA-48qf-xh34-q73r
  • mariadb (npm) Vendor— Affected 3.4.0 to before 3.4.7 Fixed in 3.4.7 Patch available GHSA-48qf-xh34-q73r
  • mariadb (npm) Vendor— Affected 3.5.0-rc.0 to before 3.5.4 Fixed in 3.5.4 Patch available GHSA-48qf-xh34-q73r

Remediation

Upgrade mariadb-connector-nodejs to fixed version 3.2.5, 3.3.4, 3.4.7, or 3.5.4 on the matching branch, and upgrade the npm mariadb package to the same fixed versions.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA mariadb-connector-nodejs (mariadb-corporation) Fixed in 3.2.5, 3.3.4, 3.4.7, 3.5.4
  • Fix · GHSA-48qf-xh34-q73r mariadb (npm) Fixed in 3.2.5 Advisory →
  • Fix · GHSA-48qf-xh34-q73r mariadb (npm) Fixed in 3.3.4 Advisory →
  • Fix · GHSA-48qf-xh34-q73r mariadb (npm) Fixed in 3.4.7 Advisory →
  • Fix · GHSA-48qf-xh34-q73r mariadb (npm) Fixed in 3.5.4 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-09 Threatist record created from CVE-2026-107383
  2. 2026-10-09 Alias added: GHSA-48qf-xh34-q73r
  3. 2026-10-10 Priority changed: MEDIUM → LOW
  4. 2026-10-14 CISA SSVC decision points changed
  5. 2026-11-06 Affected versions changed · Red Hat
  6. 2026-11-06 CVSS score added · Red Hat

References

Other 11

  • TI-2023-11776 MariaDB v10.5 was discovered to contain a remote code execution (RCE) vulnerability via… CVSS 3.1CRITICAL 9.8
  • TI-2016-05707 Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB… CVSS 3.0CRITICAL 9.8
  • TI-2022-00687 Infinite loop in BN_mod_sqrt() reachable when parsing certificates CVSS 3.1HIGH 7.5
  • TI-2014-00217 OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly… CVSS 3.1HIGH 7.4
  • TI-2014-00188 The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0… CVSS 2.0MEDIUM 6.8
  • TI-2018-15259 zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if… CVSS 3.1HIGH 7.5
See all 459 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences