Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
GHSA-qqmp-wf37-98f9
  • npm/@opentelemetry/instrumentation-cassandra-driver
  • npm/@opentelemetry/instrumentation-knex
  • npm/@opentelemetry/instrumentation-mongoose
  • npm/@opentelemetry/instrumentation-mysql
  • npm/@opentelemetry/instrumentation-mysql2
  • ... 3 more
 Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute 05 Oct
  • Fix available
  • Severity - 5.8 (Medium)
GHSA-3f6p-5ww8-9rcr
  • npm/mysql2
 MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials 01 Sep
  • Fix available
  • Severity - 8.2 (High)
GHSA-rgwj-5xj2-c3m3
  • npm/mysql2
 MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS 31 Aug
  • Fix available
  • Severity - 5.9 (Medium)
MAL-2026-537
  • npm/mysql2.js
 Malicious code in mysql2.js (npm) 27 Jan
  • No fix available
MAL-2025-17834
  • npm/custom-mysql2
 Malicious code in custom-mysql2 (npm) 14 Aug 2025
  • No fix available
MAL-2025-4514
  • npm/telegraf-mysql2-session
 Malicious code in telegraf-mysql2-session (npm) 27 May 2025
  • No fix available
GHSA-pmh2-wpjm-fj45
  • npm/mysql2
 mysql2 vulnerable to Prototype Pollution 30 May 2024
  • Fix available
  • Severity - 8.2 (High)
GHSA-4rch-2fh8-94vw
  • npm/mysql2
 MySQL2 for Node Arbitrary Code Injection 23 Apr 2024
  • Fix available
  • Severity - 9.8 (Critical)
GHSA-fpw7-j2hg-69v5
  • npm/mysql2
 mysql2 Remote Code Execution (RCE) via the readCodeFor function 11 Apr 2024
  • Fix available
  • Severity - 9.8 (Critical)
GHSA-49j4-86m8-q2jw
  • npm/mysql2
 mysql2 vulnerable to Prototype Poisoning 10 Apr 2024
  • Fix available
  • Severity - 6.9 (Medium)
GHSA-mqr2-w7wj-jjgr
  • npm/mysql2
 mysql2 cache poisoning vulnerability 10 Apr 2024
  • Fix available
  • Severity - 6.9 (Medium)