{"id":"CVE-2026-107383","published":"2026-10-08T19:17:00.783","lastModified":"2026-10-14T02:16:56.777","description":"MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, the GeoJSON Polygon and MultiPolygon binary encoders size a Buffer.allocUnsafe() allocation from each ring's numeric length before confirming that the ring is an array. A malformed non-array ring can therefore reserve bytes that the writing loop skips, and the connector sends the full buffer through execute() or batch(), disclosing uninitialized Node.js heap data into a database value. The persisted data can include other users' content, session material, database credentials, or TLS key material and may propagate to backups and replicas. The text-protocol query() path is not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-200"],"vendors":[],"products":[],"references":[{"url":"https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/2314c03b785db482599d2befd06f4992e5fc46b3","tags":[]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/a4aa048b57dc47309b80e5cc25a4a8eedb32fd9f","tags":[]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/b2ca628864b0fc2e3e94ea96910f6b693ad5bd30","tags":[]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/faa27d1b2b7753a54000f586d5148089b60d1284","tags":[]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.2.5","tags":[]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.3.4","tags":[]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.4.7","tags":[]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.5.4","tags":[]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-nodejs/security/advisories/GHSA-48qf-xh34-q73r","tags":[]},{"url":"https://jira.mariadb.org/browse/CONJS-367","tags":[]}],"exploitRefs":[{"url":"https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/2314c03b785db482599d2befd06f4992e5fc46b3","tags":[]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/a4aa048b57dc47309b80e5cc25a4a8eedb32fd9f","tags":[]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/b2ca628864b0fc2e3e94ea96910f6b693ad5bd30","tags":[]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/faa27d1b2b7753a54000f586d5148089b60d1284","tags":[]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.2.5","tags":[]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.3.4","tags":[]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.4.7","tags":[]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.5.4","tags":[]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-nodejs/security/advisories/GHSA-48qf-xh34-q73r","tags":[]}],"hasPoc":true,"ai":{"summary":"MariaDB Connector/Node.js has a buffer overflow vulnerability where uninitialized heap data gets leaked into database values when processing GeoJSON polygon and multipolygon data. This occurs because the code allocates memory based on array length before validating that the data is actually an array, potentially exposing sensitive information like session tokens, credentials, or TLS keys.","exploitability":"Exploitation requires a malicious GeoJSON polygon or multipolygon input that can be processed by the connector, with no additional preconditions needed beyond having the vulnerable version installed.","blast_radius":"The vulnerability could expose sensitive data across multiple users and systems since the leaked heap data may include session material, database credentials, or TLS key material that gets persisted to backups and replicas.","remediation":"Upgrade to MariaDB Connector/Node.js version 3.2.5, 3.3.4, 3.4.7, or 3.5.4 immediately.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["database","information-disclosure","nodejs","heap"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:25:14.073Z"}}