CVE-2026-107383

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-107383
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107383.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-107383
Aliases
Downstream
CGA (4)
Published
2026-10-08T18:27:02Z
Modified
2026-10-10T02:47:27Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters
Details

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, the GeoJSON Polygon and MultiPolygon binary encoders size a Buffer.allocUnsafe() allocation from each ring's numeric length before confirming that the ring is an array. A malformed non-array ring can therefore reserve bytes that the writing loop skips, and the connector sends the full buffer through execute() or batch(), disclosing uninitialized Node.js heap data into a database value. The persisted data can include other users' content, session material, database credentials, or TLS key material and may propagate to backups and replicas. The text-protocol query() path is not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-200"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107383.json"
}
References

Affected packages

Git / github.com/mariadb-corporation/mariadb-connector-nodejs

Affected ranges

Type
GIT
Repo
https://github.com/mariadb-corporation/mariadb-connector-nodejs
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
b65aca10b77f5ede83f16a8edd0537b2ef12a16f
Introduced
24a58245cba201da91f41f7f96f8dd165d31c6c7
Introduced
07d0183bbcf61a9cd9a5b39a74a67d676e83b4d8
Fixed
d7c1aed221af4bf811e7d13f3e29c2f7484bb0e0
Fixed
ee9b296894d0c9bcc0e0f6b9ac9316f498eecec4
Fixed
67c931b7407fc4e460aab020e7cb53bcb1c62e50
Fixed
ff43a2c80ebba9e6590afd6b9cc08ac0a290892a
Fixed
2314c03b785db482599d2befd06f4992e5fc46b3
Fixed
a4aa048b57dc47309b80e5cc25a4a8eedb32fd9f
Fixed
b2ca628864b0fc2e3e94ea96910f6b693ad5bd30
Fixed
faa27d1b2b7753a54000f586d5148089b60d1284
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.2.5"
        },
        {
            "introduced": "3.3.0"
        },
        {
            "fixed": "3.3.4"
        },
        {
            "introduced": "3.4.0"
        },
        {
            "fixed": "3.4.7"
        },
        {
            "introduced": "3.5.0-rc.0"
        },
        {
            "fixed": "3.5.4"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.7.0
2.*
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
2.3.0
2.4.0
2.4.1
2.4.2
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.5.6
3.*
3.0.0-ga
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.4.0
3.4.1
3.4.2
3.4.3
3.4.4
3.4.5
3.4.6
3.5.0-rc.0
3.5.1
3.5.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107383.json"