Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-107383

MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, the GeoJSON Polygon and MultiPolygon binary encoders size a Buffer.allocUnsafe() allocation from each ring's numeric length before confirming that the ring is an array. A malformed non-array ring can therefore reserve bytes that the writing loop skips, and the connector sends the full buffer through execute() or batch(), disclosing uninitialized Node.js heap data into a database value. The persisted data can include other users' content, session material, database credentials, or TLS key material and may propagate to backups and replicas. The text-protocol query() path is not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

mariadb-corporation mariadb-connector-nodejs

  • < 3.2.5affected
  • >= 3.3.0, < 3.3.4affected
  • >= 3.4.0, < 3.4.7affected
  • >= 3.5.0-rc.0, < 3.5.4affected

References