SQL Injection Vulnerability in MariaDB Connector/Node.js
CVE-2026-55855
6.5MEDIUM
What is CVE-2026-55855?
The MariaDB Connector/Node.js, used to interface Node.js applications with MariaDB and MySQL databases, is vulnerable to SQL injection due to improper escaping of attacker-controlled Buffer parameters when using specific client character sets. This flaw exists in versions prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3. The exploited vulnerability allows an attacker to manipulate the SQL statements sent to the database, potentially leading to unauthorized data exposure or modification. It is crucial for users to upgrade to the latest versions to mitigate this risk.
Affected Version(s)
mariadb-connector-nodejs < 3.2.4 < 3.2.4
mariadb-connector-nodejs >= 3.3.0, < 3.3.3 < 3.3.0, 3.3.3
mariadb-connector-nodejs >= 3.4.0, < 3.4.6 < 3.4.0, 3.4.6