Buffer Handling Vulnerability in MariaDB Connector/Node.js Product
CVE-2026-107383
7.5HIGH
What is CVE-2026-107383?
The MariaDB Connector/Node.js before versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4 allows for incorrect handling of Buffer.allocUnsafe() allocations due to a lack of verification on the input. Specifically, if a non-array ring is processed, it could lead to the storage of uninitialized heap data into a database value, potentially exposing sensitive information such as user content, session data, and database credentials. This vulnerability highlights critical issues with input validation and buffer management that need immediate attention to prevent data leaks and enhance overall security.
Affected Version(s)
mariadb-connector-nodejs < 3.2.5 < 3.2.5
mariadb-connector-nodejs >= 3.3.0, < 3.3.4 < 3.3.0, 3.3.4
mariadb-connector-nodejs >= 3.4.0, < 3.4.7 < 3.4.0, 3.4.7