Vulnerability-Lookup

CVE-2026-107383 (GCVE-0-2026-107383)

Vulnerability from cvelistv5 – Published: 2026-10-08 18:27 – Updated: 2026-10-08 18:27

Title

MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters

Summary

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, the GeoJSON Polygon and MultiPolygon binary encoders size a Buffer.allocUnsafe() allocation from each ring's numeric length before confirming that the ring is an array. A malformed non-array ring can therefore reserve bytes that the writing loop skips, and the connector sends the full buffer through execute() or batch(), disclosing uninitialized Node.js heap data into a database value. The persisted data can include other users' content, session material, database credentials, or TLS key material and may propagate to backups and replicas. The text-protocol query() path is not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7595 records in the last 180 days details

References

10 references

URL	Tags
https://github.com/mariadb-corporation/mariadb-co…	x_refsource_CONFIRM
https://github.com/mariadb-corporation/mariadb-co…	x_refsource_MISC
https://github.com/mariadb-corporation/mariadb-co…	x_refsource_MISC
https://github.com/mariadb-corporation/mariadb-co…	x_refsource_MISC
https://github.com/mariadb-corporation/mariadb-co…	x_refsource_MISC
https://github.com/mariadb-corporation/mariadb-co…	x_refsource_MISC
https://github.com/mariadb-corporation/mariadb-co…	x_refsource_MISC
https://github.com/mariadb-corporation/mariadb-co…	x_refsource_MISC
https://github.com/mariadb-corporation/mariadb-co…	x_refsource_MISC
https://jira.mariadb.org/browse/CONJS-367	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
mariadb-corporation	mariadb-connector-nodejs	Affected: < 3.2.5 Affected: >= 3.3.0, < 3.3.4 Affected: >= 3.4.0, < 3.4.7 Affected: >= 3.5.0-rc.0, < 3.5.4	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "mariadb-connector-nodejs",
          "vendor": "mariadb-corporation",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.2.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.3.0, \u003c 3.3.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.4.0, \u003c 3.4.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.5.0-rc.0, \u003c 3.5.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, the GeoJSON Polygon and MultiPolygon binary encoders size a Buffer.allocUnsafe() allocation from each ring\u0027s numeric length before confirming that the ring is an array. A malformed non-array ring can therefore reserve bytes that the writing loop skips, and the connector sends the full buffer through execute() or batch(), disclosing uninitialized Node.js heap data into a database value. The persisted data can include other users\u0027 content, session material, database credentials, or TLS key material and may propagate to backups and replicas. The text-protocol query() path is not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T18:27:02.543Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/security/advisories/GHSA-48qf-xh34-q73r",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/security/advisories/GHSA-48qf-xh34-q73r"
        },
        {
          "name": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/2314c03b785db482599d2befd06f4992e5fc46b3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/2314c03b785db482599d2befd06f4992e5fc46b3"
        },
        {
          "name": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/a4aa048b57dc47309b80e5cc25a4a8eedb32fd9f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/a4aa048b57dc47309b80e5cc25a4a8eedb32fd9f"
        },
        {
          "name": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/b2ca628864b0fc2e3e94ea96910f6b693ad5bd30",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/b2ca628864b0fc2e3e94ea96910f6b693ad5bd30"
        },
        {
          "name": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/faa27d1b2b7753a54000f586d5148089b60d1284",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/faa27d1b2b7753a54000f586d5148089b60d1284"
        },
        {
          "name": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.2.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.2.5"
        },
        {
          "name": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.3.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.3.4"
        },
        {
          "name": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.4.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.4.7"
        },
        {
          "name": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.5.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.5.4"
        },
        {
          "name": "https://jira.mariadb.org/browse/CONJS-367",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jira.mariadb.org/browse/CONJS-367"
        }
      ],
      "source": {
        "advisory": "GHSA-48qf-xh34-q73r",
        "discovery": "UNKNOWN"
      },
      "title": "MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-107383",
    "datePublished": "2026-10-08T18:27:02.543Z",
    "dateReserved": "2026-10-07T21:07:54.988Z",
    "dateUpdated": "2026-10-08T18:27:02.543Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-107383",
      "date": "2026-10-11",
      "epss": "0.00388",
      "percentile": "0.30928"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "mariadb-connector-nodejs",
                "vendor": "mariadb-corporation",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 3.2.5"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 3.3.0, \u003c 3.3.4"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 3.4.0, \u003c 3.4.7"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 3.5.0-rc.0, \u003c 3.5.4"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, the GeoJSON Polygon and MultiPolygon binary encoders size a Buffer.allocUnsafe() allocation from each ring\u0027s numeric length before confirming that the ring is an array. A malformed non-array ring can therefore reserve bytes that the writing loop skips, and the connector sends the full buffer through execute() or batch(), disclosing uninitialized Node.js heap data into a database value. The persisted data can include other users\u0027 content, session material, database credentials, or TLS key material and may propagate to backups and replicas. The text-protocol query() path is not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4."
          }
        ],
        "id": "CVE-2026-107383",
        "lastModified": "2026-10-08T20:25:00.647",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-10-08T19:17:00.783",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/2314c03b785db482599d2befd06f4992e5fc46b3"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/a4aa048b57dc47309b80e5cc25a4a8eedb32fd9f"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/b2ca628864b0fc2e3e94ea96910f6b693ad5bd30"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/faa27d1b2b7753a54000f586d5148089b60d1284"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.2.5"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.3.4"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.4.7"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.5.4"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/security/advisories/GHSA-48qf-xh34-q73r"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://jira.mariadb.org/browse/CONJS-367"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-200"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Primary"
          }
        ]
      }
    }
  }
}

FKIE_CVE-2026-107383

Vulnerability from fkie_nvd - Published: 2026-10-08 19:17 - Updated: 2026-10-08 20:25

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/2314c03b785db482599d2befd06f4992e5fc46b3
	security-advisories@github.com	https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/a4aa048b57dc47309b80e5cc25a4a8eedb32fd9f
	security-advisories@github.com	https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/b2ca628864b0fc2e3e94ea96910f6b693ad5bd30
	security-advisories@github.com	https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/faa27d1b2b7753a54000f586d5148089b60d1284
	security-advisories@github.com	https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.2.5
	security-advisories@github.com	https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.3.4
	security-advisories@github.com	https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.4.7
	security-advisories@github.com	https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.5.4
	security-advisories@github.com	https://github.com/mariadb-corporation/mariadb-connector-nodejs/security/advisories/GHSA-48qf-xh34-q73r
	security-advisories@github.com	https://jira.mariadb.org/browse/CONJS-367

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "mariadb-connector-nodejs",
          "vendor": "mariadb-corporation",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.2.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.3.0, \u003c 3.3.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.4.0, \u003c 3.4.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.5.0-rc.0, \u003c 3.5.4"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, the GeoJSON Polygon and MultiPolygon binary encoders size a Buffer.allocUnsafe() allocation from each ring\u0027s numeric length before confirming that the ring is an array. A malformed non-array ring can therefore reserve bytes that the writing loop skips, and the connector sends the full buffer through execute() or batch(), disclosing uninitialized Node.js heap data into a database value. The persisted data can include other users\u0027 content, session material, database credentials, or TLS key material and may propagate to backups and replicas. The text-protocol query() path is not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4."
    }
  ],
  "id": "CVE-2026-107383",
  "lastModified": "2026-10-08T20:25:00.647",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-10-08T19:17:00.783",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/2314c03b785db482599d2befd06f4992e5fc46b3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/a4aa048b57dc47309b80e5cc25a4a8eedb32fd9f"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/b2ca628864b0fc2e3e94ea96910f6b693ad5bd30"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/faa27d1b2b7753a54000f586d5148089b60d1284"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.2.5"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.3.4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.4.7"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.5.4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/security/advisories/GHSA-48qf-xh34-q73r"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://jira.mariadb.org/browse/CONJS-367"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Undergoing Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-48QF-XH34-Q73R

Vulnerability from github – Published: 2026-10-08 19:42 – Updated: 2026-10-08 19:42

Summary

MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters

Details

Description

When encoding a GeoJSON Polygon or MultiPolygon parameter for the binary protocol, the connector sized its output buffer from the length property of each ring, then wrote each ring only if it was a real array. The two loops disagreed: any non-array ring carrying a numeric length (a string, or an object such as {"length": 4000}) still reserved 4 + 16 * length bytes, but wrote none of them. The buffer came from Buffer.allocUnsafe() and was returned in full regardless of how far the write position had advanced, so every reserved-but-unwritten byte was uninitialized Node.js heap.

The sibling LineString case handled this correctly, aborting with null on the first malformed point, so no reserved byte could escape unwritten.

The only gate on this path is value.type naming a GeoJSON type, so any object shaped like {"type": "Polygon", ...} reached the encoder.

Impact

An application that passes an attacker-influenced object as a parameter to execute() or batch() writes uninitialized process memory into the database, where it is readable by anyone who can read that row and persists into backups and replicas. Applications accepting GeoJSON for map or location features are the natural case, as the attacker controls coordinates directly.

The disclosed memory is not scoped to the requesting user: in a shared Node.js process the heap may hold other users' request and response bodies, session tokens and cookies, database credentials and TLS key material. The leak is silent — the insert succeeds and the column simply holds more bytes than it should.

No non-default connector option and no particular server configuration are required. query() is not affected: the text encoder builds geometry as strings rather than through Buffer.allocUnsafe().

Resolution

Both the Polygon and MultiPolygon encoders now reject a non-array ring before reserving space for it, so no byte of the allocation can be left uninitialized by the writing loop, matching the existing LineString behaviour.

Workarounds Validate that GeoJSON coordinates are properly nested arrays of numbers before passing the object as a parameter, or use query(), until upgraded.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "mariadb"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.2.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "mariadb"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.3.0"
            },
            {
              "fixed": "3.3.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "mariadb"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.4.0"
            },
            {
              "fixed": "3.4.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "mariadb"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.5.0-rc.0"
            },
            {
              "fixed": "3.5.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-107383"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-08T19:42:11Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Description\nWhen encoding a GeoJSON Polygon or MultiPolygon parameter for the binary protocol, the connector sized its output buffer from the length property of each ring, then wrote each ring only if it was a real array. The two loops disagreed: any non-array ring carrying a numeric length (a string, or an object such as {\"length\": 4000}) still reserved 4 + 16 * length bytes, but wrote none of them. The buffer came from Buffer.allocUnsafe() and was returned in full regardless of how far the write position had advanced, so every reserved-but-unwritten byte was uninitialized Node.js heap.\n\nThe sibling LineString case handled this correctly, aborting with null on the first malformed point, so no reserved byte could escape unwritten.\n\nThe only gate on this path is value.type naming a GeoJSON type, so any object shaped like {\"type\": \"Polygon\", ...} reached the encoder.\n\n### Impact\nAn application that passes an attacker-influenced object as a parameter to execute() or batch() writes uninitialized process memory into the database, where it is readable by anyone who can read that row and persists into backups and replicas. Applications accepting GeoJSON for map or location features are the natural case, as the attacker controls coordinates directly.\n\nThe disclosed memory is not scoped to the requesting user: in a shared Node.js process the heap may hold other users\u0027 request and response bodies, session tokens and cookies, database credentials and TLS key material. The leak is silent \u2014 the insert succeeds and the column simply holds more bytes than it should.\n\nNo non-default connector option and no particular server configuration are required. query() is not affected: the text encoder builds geometry as strings rather than through Buffer.allocUnsafe().\n\n### Resolution\nBoth the Polygon and MultiPolygon encoders now reject a non-array ring before reserving space for it, so no byte of the allocation can be left uninitialized by the writing loop, matching the existing LineString behaviour.\n\n### \nWorkarounds\nValidate that GeoJSON coordinates are properly nested arrays of numbers before passing the object as a parameter, or use query(), until upgraded.",
  "id": "GHSA-48qf-xh34-q73r",
  "modified": "2026-10-08T19:42:11Z",
  "published": "2026-10-08T19:42:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/security/advisories/GHSA-48qf-xh34-q73r"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/2314c03b785db482599d2befd06f4992e5fc46b3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/a4aa048b57dc47309b80e5cc25a4a8eedb32fd9f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/b2ca628864b0fc2e3e94ea96910f6b693ad5bd30"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/faa27d1b2b7753a54000f586d5148089b60d1284"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.2.5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.3.4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.4.7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.5.4"
    },
    {
      "type": "WEB",
      "url": "https://jira.mariadb.org/browse/CONJS-367"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-107383 (GCVE-0-2026-107383)

FKIE_CVE-2026-107383

GHSA-48QF-XH34-Q73R

Description

Impact

Resolution

Tags

Sightings

Nomenclature

Related by attack behaviour