{"id":"EUVD-2026-95142","enisaUuid":"c62293bf-7415-3cbd-9826-64e435944ecc","description":"MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, the GeoJSON Polygon and MultiPolygon binary encoders size a Buffer.allocUnsafe() allocation from each ring\u0027s numeric length before confirming that the ring is an array. A malformed non-array ring can therefore reserve bytes that the writing loop skips, and the connector sends the full buffer through execute() or batch(), disclosing uninitialized Node.js heap data into a database value. The persisted data can include other users\u0027 content, session material, database credentials, or TLS key material and may propagate to backups and replicas. The text-protocol query() path is not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.","datePublished":"Oct 8, 2026, 6:27:02 PM","dateUpdated":"Oct 14, 2026, 1:11:23 AM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/mariadb-corporation/mariadb-connector-nodejs/security/advisories/GHSA-48qf-xh34-q73r\nhttps://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/2314c03b785db482599d2befd06f4992e5fc46b3\nhttps://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/a4aa048b57dc47309b80e5cc25a4a8eedb32fd9f\nhttps://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/b2ca628864b0fc2e3e94ea96910f6b693ad5bd30\nhttps://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/faa27d1b2b7753a54000f586d5148089b60d1284\nhttps://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.2.5\nhttps://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.3.4\nhttps://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.4.7\nhttps://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.5.4\nhttps://jira.mariadb.org/browse/CONJS-367\n","aliases":"CVE-2026-107383\nGHSA-48qf-xh34-q73r\n","assigner":"GitHub_M","epss":0.39,"enisaIdProduct":[{"id":"24a060ed-a136-3fb3-9839-8c5bf5e4d3b2","product":{"name":"mariadb-connector-nodejs","vendor":{"name":"mariadb-corporation"}},"product_version":"3.3.0, \u003c 3.3.4"},{"id":"5b2a31fe-ab84-3b12-97c0-77820fbe165b","product":{"name":"mariadb-connector-nodejs","vendor":{"name":"mariadb-corporation"}},"product_version":"3.5.0-rc.0, \u003c 3.5.4"},{"id":"6e4602f3-dd80-35c6-91fa-b9c4fe210316","product":{"name":"mariadb-connector-nodejs","vendor":{"name":"mariadb-corporation"}},"product_version":"\u003c 3.2.5"},{"id":"d73059b1-3b01-371c-a394-23ff32aff665","product":{"name":"mariadb-connector-nodejs","vendor":{"name":"mariadb-corporation"}},"product_version":"3.4.0, \u003c 3.4.7"}],"enisaIdVendor":[{"id":"cbfceb8f-aec6-3b8c-aae3-ed65c86d5195","vendor":{"name":"mariadb-corporation"}}],"enisaIdVulnerability":[{"id":"11ffce03-3ff6-3a90-81e7-21a3f11ed9ea","vulnerability":{"id":"GHSA-48qf-xh34-q73r","description":"MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters","datePublished":"Oct 8, 2026, 7:42:11 PM","dateUpdated":"Oct 8, 2026, 7:42:11 PM","baseScore":0.0,"references":"https://github.com/mariadb-corporation/mariadb-connector-nodejs/security/advisories/GHSA-48qf-xh34-q73r\nhttps://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/2314c03b785db482599d2befd06f4992e5fc46b3\nhttps://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/a4aa048b57dc47309b80e5cc25a4a8eedb32fd9f\nhttps://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/b2ca628864b0fc2e3e94ea96910f6b693ad5bd30\nhttps://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/faa27d1b2b7753a54000f586d5148089b60d1284\nhttps://github.com/mariadb-corporation/mariadb-connector-nodejs\nhttps://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.2.5\nhttps://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.3.4\nhttps://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.4.7\nhttps://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.5.4\nhttps://jira.mariadb.org/browse/CONJS-367\n","enisa_id":"EUVD-2026-95142\n","aliases":"CVE-2026-107383\nGHSA-48qf-xh34-q73r\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:02:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"e5dab5b5-43a4-3a92-87a9-475e13bbbe51","vulnerability":{"id":"CVE-2026-107383","description":"MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, the GeoJSON Polygon and MultiPolygon binary encoders size a Buffer.allocUnsafe() allocation from each ring\u0027s numeric length before confirming that the ring is an array. A malformed non-array ring can therefore reserve bytes that the writing loop skips, and the connector sends the full buffer through execute() or batch(), disclosing uninitialized Node.js heap data into a database value. The persisted data can include other users\u0027 content, session material, database credentials, or TLS key material and may propagate to backups and replicas. The text-protocol query() path is not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.","datePublished":"Oct 8, 2026, 6:27:02 PM","dateUpdated":"Oct 14, 2026, 1:11:23 AM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/mariadb-corporation/mariadb-connector-nodejs/security/advisories/GHSA-48qf-xh34-q73r\nhttps://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/2314c03b785db482599d2befd06f4992e5fc46b3\nhttps://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/a4aa048b57dc47309b80e5cc25a4a8eedb32fd9f\nhttps://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/b2ca628864b0fc2e3e94ea96910f6b693ad5bd30\nhttps://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/faa27d1b2b7753a54000f586d5148089b60d1284\nhttps://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.2.5\nhttps://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.3.4\nhttps://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.4.7\nhttps://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.5.4\nhttps://jira.mariadb.org/browse/CONJS-367\n","enisa_id":"EUVD-2026-95142\n","assigner":"GitHub_M","epss":0.39,"dataProcessed":"Oct 29, 2026, 7:16:26 AM","vulnerabilityProduct":[{"id":"31027662-d134-3350-b481-bc3b5d06439f","product":{"name":"mariadb-connector-nodejs","vendor":{"name":"mariadb-corporation"}},"product_version":"3.3.0, \u003c 3.3.4"},{"id":"75a26737-74e4-3df5-9892-b796ed170b1a","product":{"name":"mariadb-connector-nodejs","vendor":{"name":"mariadb-corporation"}},"product_version":"\u003c 3.2.5"},{"id":"880ea4ef-4903-38ed-8684-816fb5a7827c","product":{"name":"mariadb-connector-nodejs","vendor":{"name":"mariadb-corporation"}},"product_version":"3.5.0-rc.0, \u003c 3.5.4"},{"id":"ab74bf36-174e-3270-a206-b6669c1a0634","product":{"name":"mariadb-connector-nodejs","vendor":{"name":"mariadb-corporation"}},"product_version":"3.4.0, \u003c 3.4.7"}],"vulnerabilityVendor":[{"id":"a47ad889-6ea6-392b-a734-75c99de9f336","vendor":{"name":"mariadb-corporation"}}]}}],"enisaIdAdvisory":[]}