{"action":"Upgrade mariadb to 3.2.4 or later.","affected":[{"fixed":"3.2.4","introduced":"0"},{"fixed":"3.3.3","introduced":"3.3.0"},{"fixed":"3.4.6","introduced":"3.4.0"},{"fixed":"3.5.3","introduced":"3.5.0"}],"component":"mariadb","cve_ids":["CVE-2026-55215"],"ecosystem":"npm","epss":0.00569,"exploited":false,"fixed_versions":["3.2.4","3.3.3","3.4.6","3.5.3"],"ghsa_id":"GHSA-cqhc-2h57-wpxf","id":"tcs_01M5KFKBGB0HVQYYKZ593M8GZX","modified_at":"2026-09-02T16:25:30.304591828Z","published_at":"2026-08-28T19:03:38Z","references":["https://osv.dev/vulnerability/GHSA-cqhc-2h57-wpxf","https://github.com/mariadb-corporation/mariadb-connector-nodejs/security/advisories/GHSA-cqhc-2h57-wpxf","https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/514576a5a1fab3ea8498613e259a0b7a764e7302","https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/c47d7275835c78c7eb8186cd23e9d57c045c128b","https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/ecd36958e6e3bf0e0fa8389546f50c0ed6dbb2ac","https://hackerone.com/reports/3777370","https://github.com/mariadb-corporation/mariadb-connector-nodejs","https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.3.3","https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.4.6","https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.5.3","https://jira.mariadb.org/browse/CONJS-349"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-cqhc-2h57-wpxf","url":"https://osv.dev/vulnerability/GHSA-cqhc-2h57-wpxf"}],"summary":"MariaDB's connector leaks the cleartext password to an MitM despite `ssl: true`"}