CVE-2026-107383High· 7.5▾ TwilightMariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, the GeoJSON Polygon and MultiPolygon binary encoders size a Buffer.allocUnsafe() allo…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 10.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Last analysed / modified upstream
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, the GeoJSON Polygon and MultiPolygon binary encoders size a Buffer.allocUnsafe() allocation from each ring's numeric length before confirming that the ring is an array. A malformed non-array ring can therefore reserve bytes that the writing loop skips, and the connector sends the full buffer through execute() or batch(), disclosing uninitialized Node.js heap data into a database value. The persisted data can include other users' content, session material, database credentials, or TLS key material and may propagate to backups and replicas. The text-protocol query() path is not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
mariadb < 3.2.5mariadb >= 3.3.0, < 3.3.4mariadb >= 3.4.0, < 3.4.7mariadb >= 3.5.0-rc.0, < 3.5.4Patched in:
mariadb 3.2.5mariadb 3.3.4mariadb 3.4.7mariadb 3.5.4Connected by shared product, vendor, weakness, or advisory.
CVE-2026-107384High· 8.1MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases
CVE-2026-107385High· 7.4MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases
CVE-2026-107382Medium· 5.9MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases
CVE-2026-107821High· 8.0MariaDB server is a community developed fork of MySQL server
CVE-2026-107822Medium· 6.4MariaDB server is a community developed fork of MySQL server
CVE-2026-107823High· 7.2MariaDB server is a community developed fork of MySQL server