Homepage

mysql2@1.3.1

fast mysql driver. Implements core protocol, prepared statements, ssl and compression in native JS

  • latest version

    3.24.4

  • latest non vulnerable version

    3.24.4

  • first published

    13 years ago

  • latest version published

    2 days ago

  • licenses detected

  • View mysql2 package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the mysql2 package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Data Amplification

    mysql2 is a mostly API compatible with mysqljs and supports majority of features.

    Affected versions of this package are vulnerable to Data Amplification in the handleCompressedPacket() function of lib/compressed_protocol.js, which calls zlib.inflate(body, ...) without a maxOutputLength option and uses the packet's 3-byte length field only to branch on !== 0. An attacker can exhaust the client's memory and crash the process by returning a single small compressed packet that inflates to gigabytes at a DEFLATE ratio exceeding 1000:1. This requires the application to connect with compress: true, and the attacker to control or compromise the MySQL server endpoint or perform a MitM on a non-TLS connection.

    How to fix Data Amplification?

    Upgrade mysql2 to version 3.23.1 or higher.

    <3.23.1
    • H
    Insufficiently Protected Credentials

    mysql2 is a mostly API compatible with mysqljs and supports majority of features.

    Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the authSwitchRequest handling in lib/commands/auth_switch.js and the direct auth path in lib/commands/client_handshake.js. An attacker controlling a MySQL server or intercepting the connection can request mysql_clear_password during authentication and force the client to send the password in plaintext. This leaks user credentials over the network, letting the attacker capture login secrets and compromise accounts when the connection is not protected by TLS.

    How to fix Insufficiently Protected Credentials?

    Upgrade mysql2 to version 3.22.0 or higher.

    <3.22.0
    • H
    Prototype Pollution

    mysql2 is a mostly API compatible with mysqljs and supports majority of features.

    Affected versions of this package are vulnerable to Prototype Pollution due to improper user input sanitization passed to fields and tables when using nestTables.

    How to fix Prototype Pollution?

    Upgrade mysql2 to version 3.9.8 or higher.

    <3.9.8
    • C
    Arbitrary Code Injection

    mysql2 is a mostly API compatible with mysqljs and supports majority of features.

    Affected versions of this package are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function.

    How to fix Arbitrary Code Injection?

    Upgrade mysql2 to version 3.9.7 or higher.

    <3.9.7
    • C
    Remote Code Execution (RCE)

    mysql2 is a mostly API compatible with mysqljs and supports majority of features.

    Affected versions of this package are vulnerable to Remote Code Execution (RCE) via the readCodeFor function due to improper validation of the supportBigNumbers and bigNumberStrings values.

    How to fix Remote Code Execution (RCE)?

    Upgrade mysql2 to version 3.9.4 or higher.

    <3.9.4
    • M
    Prototype Poisoning

    mysql2 is a mostly API compatible with mysqljs and supports majority of features.

    Affected versions of this package are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through parserFn in text_parser.js and binary_parser.js.

    How to fix Prototype Poisoning?

    Upgrade mysql2 to version 3.9.4 or higher.

    <3.9.4
    • M
    Use of Web Browser Cache Containing Sensitive Information

    mysql2 is a mostly API compatible with mysqljs and supports majority of features.

    Affected versions of this package are vulnerable to Use of Web Browser Cache Containing Sensitive Information through the keyFromFields function, resulting in cache poisoning. An attacker can inject a colon (:) character within a value of the attacker-crafted key.

    How to fix Use of Web Browser Cache Containing Sensitive Information?

    Upgrade mysql2 to version 3.9.3 or higher.

    <3.9.3
    Go back to all versions of this package