{"action":"Upgrade mysql2 to 3.9.3 or later.","affected":[{"fixed":"3.9.3","introduced":"0"}],"component":"mysql2","cve_ids":["CVE-2024-21507"],"ecosystem":"npm","epss":0.00744,"exploited":false,"fixed_versions":["3.9.3"],"ghsa_id":"GHSA-mqr2-w7wj-jjgr","id":"tcs_01M5KG1HGFTXXPS0KEBRHKG87H","modified_at":"2026-09-10T03:50:12.775552783Z","published_at":"2024-04-10T15:30:39Z","references":["https://osv.dev/vulnerability/GHSA-mqr2-w7wj-jjgr","https://nvd.nist.gov/vuln/detail/CVE-2024-21507","https://github.com/sidorares/node-mysql2/pull/2424","https://github.com/sidorares/node-mysql2/commit/0d54b0ca6498c823098426038162ef10df02c818","https://blog.slonser.info/posts/mysql2-attacker-configuration","https://github.com/sidorares/node-mysql2","https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6591300"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-mqr2-w7wj-jjgr","url":"https://osv.dev/vulnerability/GHSA-mqr2-w7wj-jjgr"}],"summary":"mysql2 cache poisoning vulnerability"}