Insecure Transport Flaw in MariaDB Connector for Node.js Exposing Passwords
CVE-2026-55854
What is CVE-2026-55854?
The MariaDB Connector for Node.js, which facilitates communication between applications developed on Node.js and MariaDB/MySQL databases, contains a vulnerability where account passwords can be exposed during PAM dialog authentication over unprotected transport protocols. This issue arises due to a lack of a secure transport gate in the SendPamAuthPacketFactory for the server-side plugin dialog, leading to the potential for a malicious actor to intercept cleartext password information when the connector is used with default settings. Ensuring the use of properly validated TLS and local Unix sockets is essential to prevent exposure of sensitive information. Versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3 address this vulnerability.
Affected Version(s)
mariadb-connector-nodejs < 3.2.4 < 3.2.4
mariadb-connector-nodejs >= 3.3.0, < 3.3.3 < 3.3.0, 3.3.3
mariadb-connector-nodejs >= 3.4.0, < 3.4.6 < 3.4.0, 3.4.6