CVE-2026-55215
1 advisory.
npm/mariadb CVE-2026-55215: high 7.5, EPSS 0.57%
MariaDB's connector leaks the cleartext password to an MitM despite `ssl: true`
Action: Upgrade mariadb to 3.2.4 or later.
npm i mariadb@3.2.4npm i mariadb@3.3.3npm i mariadb@3.4.6npm i mariadb@3.5.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.2.4 | - |
| 3.3.0 | 3.3.3 | - |
| 3.4.0 | 3.4.6 | - |
| 3.5.0 | 3.5.3 | - |
Fixed versions
| 3.2.4 | 3.3.3 | 3.4.6 | 3.5.3 |
Sources
- osv: GHSA-cqhc-2h57-wpxf
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/security/advisories/GHSA-cqhc-2h57-wpxf
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/514576a5a1fab3ea8498613e259a0b7a764e7302
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/c47d7275835c78c7eb8186cd23e9d57c045c128b
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/ecd36958e6e3bf0e0fa8389546f50c0ed6dbb2ac
- https://hackerone.com/reports/3777370
- https://github.com/mariadb-corporation/mariadb-connector-nodejs
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.3.3
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.4.6
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.5.3
- https://jira.mariadb.org/browse/CONJS-349
CVE-2026-55215 · published · modified · JSON