Disclosure summary
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, the GeoJSON Polygon and MultiPolygon binary encoders size a Buffer.allocUnsafe() allocation from each ring's numeric length before confirming that the ring is an array. A malformed non-array ring can therefore reserve bytes that the writing loop skips, and the connector sends the full buffer through execute() or batch(), disclosing uninitialized Node.js heap data into a database value. The persisted data can include other users' content, session material, database credentials, or TLS key material and may propagate to backups and replicas. The text-protocol query() path is not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.
Source-reported weakness categories
CWE-200
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
NIST National Vulnerability Database · NVD-CVE-2026-107383
Open original source · Updated Oct 08, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
GitHub Reviewed Security Advisories · GHSA-48qf-xh34-q73r
Open original source · Updated Oct 08, 2026
MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters
Source severity: HIGH / 0
| Ecosystem | Package | Affected range | First patched |
|---|---|---|---|
| npm | mariadb | < 3.2.5 | 3.2.5 |
| npm | mariadb | >= 3.3.0, < 3.3.4 | 3.3.4 |
| npm | mariadb | >= 3.4.0, < 3.4.7 | 3.4.7 |
| npm | mariadb | >= 3.5.0-rc.0, < 3.5.4 | 3.5.4 |
Original records & references
- NIST NVD record
- CVE Program record
- github.com
- github.com
- github.com
- github.com
- github.com
- github.com
- github.com
- github.com
- github.com
- jira.mariadb.org
PUBLISHED 2026-10-08T15:17:00-04:00
MODIFIED 2026-10-08T16:25:00-04:00
INGESTED 2026-10-10T20:55:03-04:00