p PatchFirst

CVE-2026-107383

CVE-2026-107383 · MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters

This page contains facts from public vulnerability sources. Check the original advisory before updating.

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, the GeoJSON Polygon and MultiPolygon binary encoders size a Buffer.allocUnsafe() allocation from each ring's numeric length before confirming that the ring is an array. A malformed non-array ring can therefore reserve bytes that the writing loop skips, and the connector sends the full buffer through execute() or batch(), disclosing uninitialized Node.js heap data into a database value. The persisted data can include other users' content, session material, database credentials, or TLS key material and may propagate to backups and replicas. The text-protocol query() path is not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.

CVSS 7.5 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: node · database

Affected products and versions

  • mariadb-connector-nodejs

    Versions
    • < 3.2.5: Affected
    • >= 3.3.0, < 3.3.4: Affected
    • >= 3.4.0, < 3.4.7: Affected
    • >= 3.5.0-rc.0, < 3.5.4: Affected

    No fix published

  • mariadb npm

    Affected ranges
    • SEMVER: < 3.2.5

    Update to 3.2.5

  • mariadb npm

    Affected ranges
    • SEMVER: ≥ 3.3.0, < 3.3.4

    Update to 3.3.4

  • mariadb npm

    Affected ranges
    • SEMVER: ≥ 3.4.0, < 3.4.7

    Update to 3.4.7

  • mariadb npm

    Affected ranges
    • SEMVER: ≥ 3.5.0-rc.0, < 3.5.4

    Update to 3.5.4

Original sources

Check your server →