Homepage

mysql2@0.8.13 vulnerabilities

fast mysql driver. Implements core protocol, prepared statements, ssl and compression in native JS

  • latest version

    3.11.5

  • latest non vulnerable version

    3.11.6-canary.9a386018

  • first published

    11 years ago

  • latest version published

    17 days ago

  • licenses detected

  • View mysql2 package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the mysql2 package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Prototype Pollution

    mysql2 is a mostly API compatible with mysqljs and supports majority of features.

    Affected versions of this package are vulnerable to Prototype Pollution due to improper user input sanitization passed to fields and tables when using nestTables.

    How to fix Prototype Pollution?

    Upgrade mysql2 to version 3.9.8 or higher.

    <3.9.8
    • C
    Arbitrary Code Injection

    mysql2 is a mostly API compatible with mysqljs and supports majority of features.

    Affected versions of this package are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function.

    How to fix Arbitrary Code Injection?

    Upgrade mysql2 to version 3.9.7 or higher.

    <3.9.7
    • C
    Remote Code Execution (RCE)

    mysql2 is a mostly API compatible with mysqljs and supports majority of features.

    Affected versions of this package are vulnerable to Remote Code Execution (RCE) via the readCodeFor function due to improper validation of the supportBigNumbers and bigNumberStrings values.

    How to fix Remote Code Execution (RCE)?

    Upgrade mysql2 to version 3.9.4 or higher.

    <3.9.4
    • M
    Prototype Poisoning

    mysql2 is a mostly API compatible with mysqljs and supports majority of features.

    Affected versions of this package are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through parserFn in text_parser.js and binary_parser.js.

    How to fix Prototype Poisoning?

    Upgrade mysql2 to version 3.9.4 or higher.

    <3.9.4
    • M
    Use of Web Browser Cache Containing Sensitive Information

    mysql2 is a mostly API compatible with mysqljs and supports majority of features.

    Affected versions of this package are vulnerable to Use of Web Browser Cache Containing Sensitive Information through the keyFromFields function, resulting in cache poisoning. An attacker can inject a colon (:) character within a value of the attacker-crafted key.

    How to fix Use of Web Browser Cache Containing Sensitive Information?

    Upgrade mysql2 to version 3.9.3 or higher.

    <3.9.3
    • M
    Man in The Middle (MiTM)

    mysql2 is a mostly API compatible with mysqljs and supports majority of features.

    Affected versions of this package are vulnerable to Man in The Middle (MiTM). The package does not verify remote certificates and reject unauthorized SSL connections.

    How to fix Man in The Middle (MiTM)?

    Upgrade mysql2 to version 1.0.0-rc.1 or higher.

    <1.0.0-rc.1
    Go back to all versions of this package