Mariadb Connector Nodejs
Approved changes feed: RSS · Atom
cpe:2.3:a:mariadb-corporation:mariadb-connector-nodejs:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Mariadb Corporation (f5e45012-1f60-56cf-be74-836ad18f85e0) |
|---|---|
| Product | Mariadb Connector Nodejs (ab53b329-6fc4-5ff4-961c-11d989674794) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/mariadb-corporation/mariadb-connector-nodejs |
purl2cpe | 2026-09-09 08:34:18.942115 |
pkg:npm/mariadb |
purl2cpe | 2026-09-09 08:34:18.942117 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-107383 |
vulnerable | 2026-11-03 10:15:59.171790 |
MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters
HIGH (7.5)
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, the GeoJSON Polygon and MultiPolygon binary encoders size a Buffer.allocUnsafe() allocation from each ring's numeric length before confirming that the ring is an array. A malformed non-array ring can therefore reserve bytes that the writing loop skips, and the connector sends the full buffer through execute() or batch(), disclosing uninitialized Node.js heap data into a database value. The persisted data can include other users' content, session material, database credentials, or TLS key material and may propagate to backups and replicas. The text-protocol query() path is not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.
Published: 2026-10-08T18:27:02.543Z
Updated: 2026-10-14T01:11:23.281Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.