7vulnerabilities
- Critical2 (28.6%)
- High2 (28.6%)
- Medium0 (0.0%)
- Moderate3 (42.9%)
- Low0 (0.0%)
mysql2
Ecosystem: npm
Downloads: 75.5 Mln
- 2CriticalAffects 2 versions
- 2HighAffects 2 versions
- 0MediumAffects 0 versions
- 3ModerateAffects 3 versions
- 0LowAffects 0 versions
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
- 4 vulnerabilities
- Critical: 2
- High: 0
- Medium: 0
- Moderate: 2
- Low: 0
Vulnerabilities (7)
Known vulnerabilities affecting mysql2, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-3f6p-5ww8-9rcr | High | MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials## Summary A rogue MySQL server (or MITM) can force mysql2 to send credentials in **plaintext** by requesting an auth switch to `mysql_clear_password`. The driver complies without verifying that TLS is active. ## Details `mysql_clear_password` is registered as a default standard plugin in `lib/commands/auth_switch.js` (line 21). When a server sends an AuthSwitchRequest (0xFE) requesting `mysql_clear_password`, the driver executes it without checking for TLS. The plugin (`lib/auth_plugins/mysql_clear_password.js`) returns `Buffer.from(password + '\0')`. Note: `caching_sha2_password` plugin |
| GitHub (opens in a new tab) | |
| GHSA-rgwj-5xj2-c3m3 | Moderate | MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS## Vulnerability Details **File**: `lib/compressed_protocol.js` **Line**: 43 (`zlib.inflate(body, (err, data) => { ... })` inside `handleCompressedPacket`) ### Root Cause When a connection is created with `compress: true` (and the server advertises `CLIENT_COMPRESS`), every incoming packet is unwrapped by `handleCompressedPacket()` in `lib/compressed_protocol.js`, which calls: ```js zlib.inflate(body, (err, data) => { ... }); ``` No options object (in particular, no `maxOutputLength`) is passed. Node's zlib convenience methods default `maxOutputLength` to `buffer.kMaxLength`, which on this |
| GitHub (opens in a new tab) | |
| GHSA-pmh2-wpjm-fj45 | High | mysql2 vulnerable to Prototype PollutionVersions of the package mysql2 before 3.9.8 are vulnerable to Prototype Pollution due to improper user input sanitization passed to fields and tables when using nestTables. |
| GitHub (opens in a new tab) | |
| GHSA-4rch-2fh8-94vw | Critical | MySQL2 for Node Arbitrary Code InjectionVersions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function. |
| GitHub (opens in a new tab) | |
| GHSA-fpw7-j2hg-69v5 | Critical | mysql2 Remote Code Execution (RCE) via the readCodeFor functionVersions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the `readCodeFor` function due to improper validation of the `supportBigNumbers` and `bigNumberStrings` values. |
| GitHub (opens in a new tab) | |
| GHSA-49j4-86m8-q2jw | Moderate | mysql2 vulnerable to Prototype PoisoningVersions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through `parserFn` in `text_parser.js` and `binary_parser.js`. |
| GitHub (opens in a new tab) | |
| GHSA-mqr2-w7wj-jjgr | Moderate | mysql2 cache poisoning vulnerabilityVersions of the package mysql2 before 3.9.3 are vulnerable to Improper Input Validation through the `keyFromFields` function, resulting in cache poisoning. An attacker can inject a colon `:` character within a value of the attacker-crafted key. |
| GitHub (opens in a new tab) |
- GHSA-3f6p-5ww8-9rcrHighMySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials
< 3.22.0
## Summary A rogue MySQL server (or MITM) can force mysql2 to send credentials in **plaintext** by requesting an auth switch to `mysql_clear_password`. The driver complies without verifying that TLS is active. ## Details `mysql_clear_password` is registered as a default standard plugin in `lib/commands/auth_switch.js` (line 21). When a server sends an AuthSwitchRequest (0xFE) requesting `mysql_clear_password`, the driver executes it without checking for TLS. The plugin (`lib/auth_plugins/mysql_clear_password.js`) returns `Buffer.from(password + '\0')`. Note: `caching_sha2_password` plugin
- GHSA-rgwj-5xj2-c3m3ModerateMySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS
< 3.23.1
## Vulnerability Details **File**: `lib/compressed_protocol.js` **Line**: 43 (`zlib.inflate(body, (err, data) => { ... })` inside `handleCompressedPacket`) ### Root Cause When a connection is created with `compress: true` (and the server advertises `CLIENT_COMPRESS`), every incoming packet is unwrapped by `handleCompressedPacket()` in `lib/compressed_protocol.js`, which calls: ```js zlib.inflate(body, (err, data) => { ... }); ``` No options object (in particular, no `maxOutputLength`) is passed. Node's zlib convenience methods default `maxOutputLength` to `buffer.kMaxLength`, which on this
Versions of the package mysql2 before 3.9.8 are vulnerable to Prototype Pollution due to improper user input sanitization passed to fields and tables when using nestTables.
CVE: CVE-2024-21512
- GHSA-4rch-2fh8-94vwCriticalMySQL2 for Node Arbitrary Code Injection
< 3.9.7
Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function.
CVE: CVE-2024-21511
- GHSA-fpw7-j2hg-69v5Criticalmysql2 Remote Code Execution (RCE) via the readCodeFor function
< 3.9.4
Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the `readCodeFor` function due to improper validation of the `supportBigNumbers` and `bigNumberStrings` values.
CVE: CVE-2024-21508
- GHSA-49j4-86m8-q2jwModeratemysql2 vulnerable to Prototype Poisoning
< 3.9.4
Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through `parserFn` in `text_parser.js` and `binary_parser.js`.
CVE: CVE-2024-21509
Versions of the package mysql2 before 3.9.3 are vulnerable to Improper Input Validation through the `keyFromFields` function, resulting in cache poisoning. An attacker can inject a colon `:` character within a value of the attacker-crafted key.
CVE: CVE-2024-21507