CVE-2026-107384: MariaDB Connector/Node.js SQL Injection via Object Keys in SET Expansion
Summary
CVE-2026-107384: Description With the non-default permitSetMultiParamEntries option enabled, an object passed as a query parameter is expanded into a SET clause, each key becoming a column name. Affects mariadb across 4 version ranges.
>= 3.2.0, < 3.2.5
>= 3.3.0, < 3.3.4
>= 3.4.0, < 3.4.7
>= 3.5.0-rc.0, < 3.5.4
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- mysql-client · Bitnami
- mariadb-min · Bitnami
- mariadb · Bitnami
The same CVE-2026-107384 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
MariaDB is an open-source relational database management system that is widely used for web applications and data storage. The MariaDB Connector/Node.js allows Node.js applications to interact with MariaDB databases seamlessly. It provides features such as connection pooling, prepared statements, and support for various data types. However, a vulnerability has been identified in the connector that could lead to SQL injection attacks when specific options are enabled.
Vulnerability Detail
The vulnerability arises from the 'permitSetMultiParamEntries' option, which, when enabled, allows an object passed as a query parameter to be expanded into a SET clause. The issue occurs because the keys of the object are not properly escaped, allowing an attacker to inject arbitrary SQL code. This can lead to unauthorized access to sensitive data or manipulation of the database. The vulnerability was not fully addressed in a previous fix, leaving certain code paths vulnerable to SQL injection.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.2.0, < 3.2.53.2.5npm install mariadb@3.2.5 -
>= 3.3.0, < 3.3.43.3.4npm install mariadb@3.3.4 -
>= 3.4.0, < 3.4.73.4.7npm install mariadb@3.4.7 -
>= 3.5.0-rc.0, < 3.5.43.5.4npm install mariadb@3.5.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can disable the 'permitSetMultiParamEntries' option, which is off by default. Alternatively, validate object keys against an allow-list of column names before passing them to the query function. Example code for validation:
const allowedKeys = ['name', 'email', 'role'];
const isValidKey = (key) =>
allowedKeys.
includes(key);
if (!
isValidKey(key)) throw new Error('Invalid key');
Conclusion
The CVE-2026-107384 vulnerability in the MariaDB Connector/Node.js poses a significant risk of SQL injection attacks when certain options are enabled. It is crucial to update to the patched versions or implement workarounds to protect your application from potential exploitation.
See every vulnerability recorded for mariadb →
FAQ
The vulnerability allows attackers to inject arbitrary SQL code, potentially leading to unauthorized access to sensitive data or database manipulation.
If you are using the MariaDB Connector/Node.js with the 'permitSetMultiParamEntries' option enabled and are passing user-controlled object keys, your application may be vulnerable.
Versions 3.2.0 to 3.2.4, 3.3.0 to 3.3.3, 3.4.0 to 3.4.6, and 3.5.0-rc.0 to 3.5.3 are affected. Upgrade to the fixed versions to mitigate the risk.
You can disable the 'permitSetMultiParamEntries' option or validate object keys against an allow-list of column names as a temporary workaround.
Vulert monitors and alerts in real-time for open-source vulnerabilities in your software using just the package-lock.json file. You can check if your application is affected by this vulnerability using the Vulert playground.
References
Related vulnerabilities
Recent vulnerabilities recorded for mariadb.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
