MariaDB Corporation MariaDB Connector Node.js up to 3.2.4/3.3.3/3.4.6/3.5.3 GeoJSON Encoder uninitialized pointer

Summaryinfo

A vulnerability has been found in MariaDB Corporation MariaDB Connector Node.js up to 3.2.4/3.3.3/3.4.6/3.5.3 and classified as problematic. This impacts an unknown function of the component GeoJSON Encoder. The manipulation leads to uninitialized pointer. This vulnerability is listed as CVE-2026-107383. The attack may be initiated remotely. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in MariaDB Corporation MariaDB Connector Node.js up to 3.2.4/3.3.3/3.4.6/3.5.3. This issue affects an unknown part of the component GeoJSON Encoder. The manipulation with an unknown input leads to a uninitialized pointer vulnerability. Using CWE to declare the problem leads to CWE-824. The product accesses or uses a pointer that has not been initialized. Impacted is confidentiality. The summary by CVE is:

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, the GeoJSON Polygon and MultiPolygon binary encoders size a Buffer.allocUnsafe() allocation from each ring's numeric length before confirming that the ring is an array. A malformed non-array ring can therefore reserve bytes that the writing loop skips, and the connector sends the full buffer through execute() or batch(), disclosing uninitialized Node.js heap data into a database value. The persisted data can include other users' content, session material, database credentials, or TLS key material and may propagate to backups and replicas. The text-protocol query() path is not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-107383 since 10/07/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 3.2.5, 3.3.4, 3.4.7 or 3.5.4 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• JavaScript Library

Vendor

• MariaDB Corporation

Name

• MariaDB Connector Node.js

Version

• 3.2.0
• 3.2.1
• 3.2.2
• 3.2.3
• 3.2.4
• 3.3.0
• 3.3.1
• 3.3.2
• 3.3.3
• 3.4.0
• 3.4.1
• 3.4.2
• 3.4.3
• 3.4.4
• 3.4.5
• 3.4.6
• 3.5.0
• 3.5.1
• 3.5.2
• 3.5.3

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion