CVE-2026-107383 in MariaDB Connector Node.js
Summary
by MITRE • 10/08/2026
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, the GeoJSON Polygon and MultiPolygon binary encoders size a Buffer.allocUnsafe() allocation from each ring's numeric length before confirming that the ring is an array. A malformed non-array ring can therefore reserve bytes that the writing loop skips, and the connector sends the full buffer through execute() or batch(), disclosing uninitialized Node.js heap data into a database value. The persisted data can include other users' content, session material, database credentials, or TLS key material and may propagate to backups and replicas. The text-protocol query() path is not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/08/2026
The MariaDB Connector for Node.js serves as a critical bridge allowing applications built on the JavaScript runtime to interact with MariaDB and MySQL database systems. In versions prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, a significant memory safety vulnerability exists within the handling of GeoJSON spatial data structures, specifically affecting Polygon and MultiPolygon binary encoders. This flaw stems from an improper allocation strategy where the connector initializes a buffer using Buffer.allocUnsafe based on numeric length values extracted from ring coordinates before verifying that these rings are valid arrays. The use of allocUnsafe is inherently risky in Node.js environments because it does not zero out memory, leaving previously allocated heap data intact and potentially accessible to subsequent operations if not explicitly overwritten.
The technical core of this vulnerability lies in the sequence of validation checks during the encoding process. When processing GeoJSON geometries, the connector attempts to determine the size required for a buffer by reading numeric lengths associated with geometric rings. However, it fails to first confirm that these ring definitions are actually arrays as expected by the data structure specification. If an attacker provides a malformed input where a ring is not an array but contains properties or values that allow length extraction, the connector proceeds to allocate a large block of uninitialized memory based on those potentially inflated or arbitrary numeric lengths. This allocation reserves bytes in the Node.js heap without initializing them with zeros, creating a window for information disclosure if the subsequent writing loop does fully populate every byte of this buffer.
Because the validation occurs after the allocation but before the data is written to the database via execute() or batch(), there is a scenario where the connector sends the full allocated buffer to the database server even though only a portion of it contains valid geometric data derived from the input. The unwritten portions of the buffer retain their previous state in memory, which may contain sensitive information such as other users' content, session tokens, database credentials, or TLS key material that was previously stored and not yet garbage collected. This results in an out-of-bounds read vulnerability where uninitialized heap data is persisted into a database value rather than being discarded or zeroed out. The text-protocol query() path remains unaffected because it does not utilize the same binary encoding mechanisms prone to this specific memory handling error, limiting the attack surface primarily to applications using the binary protocol for spatial data insertion.
The operational impact of this vulnerability is severe due to the persistence mechanism inherent in database systems. Unlike transient network leaks that might be lost after a connection closes, data written to MariaDB or MySQL is stored on disk and often replicated across multiple nodes or backed up regularly. Consequently, sensitive information leaked through this buffer overflow can propagate widely within an organization's infrastructure, potentially exposing credentials or proprietary data to unauthorized parties who have access to the database backups or replicas. This persistence transforms a temporary memory leak into a long-term security risk that is difficult to remediate once discovered in historical records.
This vulnerability aligns with CWE-120 Buffer Copy without Checking Size of Input and CWE-94 Improper Control of Generation of Code, as well as the specific issue of using uninitialized memory which maps closely to CWE-908 Use of Uninitialized Resource. In terms of adversary tactics, this flaw facilitates information discovery through data exposure, corresponding to ATT&CK technique T1530 Data from Local System or potentially T1074 Data Staged if used for exfiltration preparation. To mitigate this risk, organizations must immediately upgrade the MariaDB Connector/Node.js package to version 3.2.5, 3.3.4, 3.4.7, or 3.5.4 and later, where the validation logic has been corrected to ensure rings are verified as arrays before any memory allocation occurs. Additionally, developers should implement strict input validation on all GeoJSON inputs at the application layer to reject malformed geometries early in the request lifecycle, reducing reliance solely on library-level protections.