SQL Injection Risk in MariaDB Connector for Node.js by MariaDB Corporation
CVE-2026-107384
What is CVE-2026-107384?
The MariaDB Connector/Node.js, specifically versions 3.2.0 to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, allows applications with enabled permitSetMultiParamEntries to exploit an SQL injection vulnerability. This occurs when attacker-controlled keys are processed without proper sanitization, enabling the inclusion of malicious SQL code. If keys containing backticks are submitted, they may inadvertently terminate the quoted identifier, allowing unauthorized updates to database columns. Fortunately, this critical issue is not applicable when serialized-object handling is employed or when the option is disabled by default. For remediation, users should upgrade to the fixed versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.
Affected Version(s)
mariadb-connector-nodejs >= 3.2.0, < 3.2.5 < 3.2.0, 3.2.5
mariadb-connector-nodejs >= 3.3.0, < 3.3.4 < 3.3.0, 3.3.4
mariadb-connector-nodejs >= 3.4.0, < 3.4.7 < 3.4.0, 3.4.7