Homepage

mysql2@3.19.2-canary.c06afc25

fast mysql driver. Implements core protocol, prepared statements, ssl and compression in native JS

  • latest version

    3.24.4

  • latest non vulnerable version

    3.24.4

  • first published

    13 years ago

  • latest version published

    5 days ago

  • licenses detected

  • View mysql2 package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the mysql2 package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Data Amplification

    mysql2 is a mostly API compatible with mysqljs and supports majority of features.

    Affected versions of this package are vulnerable to Data Amplification in the handleCompressedPacket() function of lib/compressed_protocol.js, which calls zlib.inflate(body, ...) without a maxOutputLength option and uses the packet's 3-byte length field only to branch on !== 0. An attacker can exhaust the client's memory and crash the process by returning a single small compressed packet that inflates to gigabytes at a DEFLATE ratio exceeding 1000:1. This requires the application to connect with compress: true, and the attacker to control or compromise the MySQL server endpoint or perform a MitM on a non-TLS connection.

    How to fix Data Amplification?

    Upgrade mysql2 to version 3.23.1 or higher.

    <3.23.1
    • H
    Insufficiently Protected Credentials

    mysql2 is a mostly API compatible with mysqljs and supports majority of features.

    Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the authSwitchRequest handling in lib/commands/auth_switch.js and the direct auth path in lib/commands/client_handshake.js. An attacker controlling a MySQL server or intercepting the connection can request mysql_clear_password during authentication and force the client to send the password in plaintext. This leaks user credentials over the network, letting the attacker capture login secrets and compromise accounts when the connection is not protected by TLS.

    How to fix Insufficiently Protected Credentials?

    Upgrade mysql2 to version 3.22.0 or higher.

    <3.22.0
    Go back to all versions of this package