# CVE-2024-21507: mysql2 cache poisoning vulnerability

Source: https://junglewise.ai/threats/cve-2024-21507-mysql2-cache-poisoning-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-04-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-21507 · Severity: low · CVSS 3.1 · Published 2024-04-10

mysql2 is a popular Node.js driver for connecting to MySQL databases. A cache poisoning vulnerability in versions before 3.9.3 allows attackers to inject colon characters into cache keys, potentially causing the wrong cached query results to be returned. This could expose sensitive data or cause applications to use stale or incorrect information from the database.

Technologies: [mysql2 (npm)](https://junglewise.ai/threats/technologies/mysql2). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2024-21507 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-21507 being exploited in the wild.

**How severe is CVE-2024-21507?** Low severity, with a CVSS score of 3.1, published 10 April 2024.

**Which products and versions are affected?** mysql2 (npm) before 3.9.3.

**Is there a fix for CVE-2024-21507?** A patch was published on 2024-03-26: Fixed in version 3.9.3 via PR #2424 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-21507 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-21507?** Check whether you run mysql2 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the keyFromFields function in mysql2 before 3.9.3, where improper input validation (CWE-20) allows an attacker to inject a colon character within cache key values. By crafting specific input, an attacker can poison the query result cache, causing the application to return incorrect cached data. The attack requires network access to an application using mysql2 but no authentication or user interaction. An attacker can exploit this to retrieve sensitive information or cause the application to operate with stale data. The vulnerability is fixed in version 3.9.3 through improved cache key serialization.

## Affected products

- npm mysql2 before 3.9.3

## Identifiers

- CVE-2024-21507
- GHSA-mqr2-w7wj-jjgr

## Timeline

- 2024-04-10: disclosed
- 2024-03-26: patched: Fixed in version 3.9.3 via PR #2424

## References

- [https://github.com/sidorares/node-mysql2/pull/2424](https://github.com/sidorares/node-mysql2/pull/2424)

## Related threats

- [MySQL2 auth plugin downgrade to mysql_clear_password leaks plaintext credentials](https://junglewise.ai/threats/mysql2-auth-plugin-downgrade-to-mysql-clear-password-leaks-plaintext-4f504449)
- [MySQL2 unbounded zlib inflate decompression-bomb DoS](https://junglewise.ai/threats/mysql2-unbounded-zlib-inflate-decompression-bomb-dos-1b8791b1)
- [mysql2 prototype pollution in nestTables](https://junglewise.ai/threats/cve-2024-21512-mysql2-prototype-pollution-in-nesttables)
- [mysql2 for Node arbitrary code injection via timezone parameter](https://junglewise.ai/threats/cve-2024-21511-mysql2-for-node-arbitrary-code-injection-via-timezone-parameter)
- [mysql2 remote code execution in readCodeFor function](https://junglewise.ai/threats/cve-2024-21508-mysql2-remote-code-execution-in-readcodefor-function)