MariaDB Connector/Node.js 3.3.3 Security Fixes: SQLi, MITM, and Plaintext Password Vulnerabilities

MariaDB Connector/Node.js 3.3.3 Vulnerability Fix Summary Vulnerability Overview This release (version 3.3.3, released in June 2026) addresses multiple security issues, primarily involving SQL injection, Man-in-the-Middle (MITM) attacks, and plaintext password transmission. Scope of Impact CONJS-359: Improper escaping of Buffer parameters using the / / / client character sets, potentially leading to SQL injection. CONJS-348: Under certificate fingerprint verification (self-signed trust mode), passwords may be leaked to a Man-in-the-Middle attacker. CONJS-349: Certificate fingerprint token verification now uses constant-time comparison to prevent timing side-channel leakage of the token to a Man-in-the-Middle attacker. CONJS-353: When PAM (dialog) authentication transmits passwords in plaintext, a secure connection (TLS or local Unix socket) is now required. CONJS-354: When is disabled, server-issued requests are rejected. CONJS-354: Sending passwords in plaintext ( ) over encrypted connections is rejected. Remediation Fixed the escaping logic for the family of character sets within Buffer parameters to prevent SQL injection. In self-signed trust mode, reliance on certificate fingerprint verification to prevent password leakage has been removed. Implemented constant-time comparison for certificate fingerprint token verification to eliminate timing side-channels. PAM authentication now mandates a TLS or local Unix socket connection. When is disabled, requests are rejected. The use of plaintext authentication is prohibited over encrypted connections. POC/Exploit Code No POC or exploit code blocks are included in the release notes.

Goal Reached Thanks to every supporter — we hit 100%!

MariaDB Connector/Node.js 3.3.3 Security Fixes: SQLi, MITM, and Plaintext Password Vulnerabilities

More from this source