npm/mariadb CVE-2026-107384: high 8.1
MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)
Action: Upgrade mariadb to 3.2.5 or later.
npm i mariadb@3.2.5npm i mariadb@3.3.4npm i mariadb@3.4.7npm i mariadb@3.5.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.2.0 | 3.2.5 | - |
| 3.3.0 | 3.3.4 | - |
| 3.4.0 | 3.4.7 | - |
| 3.5.0-rc.0 | 3.5.4 | - |
Fixed versions
| 3.2.5 | 3.3.4 | 3.4.7 | 3.5.4 |
Sources
- osv: GHSA-v6pj-gxxw-phfw
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/security/advisories/GHSA-v6pj-gxxw-phfw
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/144b8f4ef29539a9fb4b75d972b9dcdac4088b4e
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/6743b2f4a89b074268b44c650170767f35e1fb5d
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/8eb450972ff0f3826d7d45c071a42240798bc826
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/b9b04ec82a60b2caf2b0c038259ca9aff5d7014a
- https://hackerone.com/reports/3889198
- https://github.com/mariadb-corporation/mariadb-connector-nodejs
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.2.5
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.3.4
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.4.7
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.5.4
- https://jira.mariadb.org/browse/CONJS-369
CVE-2026-107384 · published · modified · JSON