MariaDB Connector/Node.js 3.5.4 Security Fixes: SQL Injection, DoS, Memory Leak

MariaDB Connector/Node.js 3.5.4 Vulnerability Summary Vulnerability Overview CONJS-355: Avoid cloning connection options for each command; use prototype chain merging instead. CONJS-357: Add JavaScript SAST (CodeQL + eslint-plugin-security) to the CI pipeline. CONJS-365: Enable standard TLS certificate authentication in Deno. CONJS-360: New option (default 65535) limits the number of result set columns announced by the server, preventing the client from allocating metadata that will never complete. Affected Areas CONJS-328: Callback exceptions were reported as database errors instead of being propagated like other Node-style callbacks. CONJS-356: Fixed issues with ed25519 authentication and zero-configuration SSL. CONJS-358: Refused to reassemble multi-part packets (>16MB) before authentication completion, preventing malicious servers from exhausting client memory. CONJS-359: Corrected behavior when default value was not set. CONJS-360: Ignored regarding / / options. CONJS-361: After command execution, the connection stopped sending commands, causing prepared statements to never execute, with no errors or timeouts. CONJS-362: Limited parsing of PBKDF2 iteration factors for authentication and moved key derivation out of the event loop, preventing malicious servers from freezing the entire process. CONJS-363: The accessor returned corrupted values related to prepared statements. CONJS-364: The / enumeration threw exceptions at runtime. CONJS-367: Uninitialized process memory leak via malicious GeoJSON parameters. CONJS-368: Fixed SQL injection in the text protocol when is used. CONJS-369: Fixed SQL injection in object keys when is used. Remediation CONJS-355: Use prototype chain merging instead of cloning connection options. CONJS-357: Add JavaScript SAST to the CI pipeline. CONJS-365: Enable standard TLS certificate authentication in Deno. CONJS-360: Set default value to 65535. CONJS-328: Fixed callback exception propagation issues. CONJS-356: Fixed ed25519 authentication and zero-configuration SSL issues. CONJS-358: Refuse to reassemble multi-part packets before authentication is completed. CONJS-359: Fixed behavior when default value is not set. CONJS-360: Ignore related options for . CONJS-361: Fixed the issue where the connection stopped sending commands after command completion. CONJS-362: Limited parsing of PBKDF2 iteration factors for authentication and moved key derivation out of the event loop. CONJS-363: Fixed the issue where the accessor returned corrupted values. CONJS-364: Fixed the issue where the / enumeration threw exceptions at runtime. CONJS-367: Fixed uninitialized process memory leak issues. CONJS-368: Fixed SQL injection in the text protocol when is used. CONJS-369: Fixed SQL injection in object keys when is used. No POC code or exploit code is included in this page.

Goal Reached Thanks to every supporter — we hit 100%!

MariaDB Connector/Node.js 3.5.4 Security Fixes: SQL Injection, DoS, Memory Leak

More from this source