CVE-2026-107382: MariaDB Connector/Node.js Uncaught Exception Crashes Client During ed25519 Authentication

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

MariaDB Connector/Node.js is a library that allows Node.js applications to connect to MariaDB databases. It supports various authentication methods and provides features like zero-configuration TLS for secure connections. However, a vulnerability has been identified in the ed25519 authentication method when using zero-configuration TLS, which can lead to client crashes under certain conditions.

Vulnerability Detail

The vulnerability arises from a ReferenceError in the Ed25519PasswordAuth.hash() method, where a variable 'seed' is referenced but not defined in the method's scope. This error occurs during the socket data handling process, causing an uncaught exception that crashes the client application. The impact is a denial of service, as the client process terminates unexpectedly, affecting availability without disclosing credentials or altering data. An attacker can exploit this by intercepting the connection and presenting a self-signed certificate, leading to a crash when the client attempts to authenticate.

npm install mariadb@3.5.4

Workaround

As a temporary workaround, you can provide the server certificate to the client by configuring SSL options in your connection settings. Use the following code snippet:

const mariadb = require('mariadb');
const pool = mariadb.createPool({
  host: 'your-host',
  user: 'your-user',
  password: 'your-password',
  ssl: { ca: 'path/to/your/server-cert.pem' }
});

Alternatively, you can set 'rejectUnauthorized' to false:

const pool = mariadb.createPool({
  host: 'your-host',
  user: 'your-user',
  password: 'your-password',

ssl: { rejectUnauthorized: false }

});

Conclusion

In summary, CVE-2026-107382 affects the MariaDB Connector/Node.js, leading to client crashes during ed25519 authentication with zero-configuration TLS. The issue can be resolved by upgrading to version 3.5.4 or later, and temporary workarounds are available to mitigate the impact until an upgrade can be performed.

See every vulnerability recorded for mariadb →

FAQ