# CVE-2026-107382: MariaDB Connector/Node.js uncaught exception in Ed25519 authentication with zero-config TLS

Source: https://junglewise.ai/threats/cve-2026-107382-mariadb-connector-node-js-uncaught-exception-crashes-the-client  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-08. Updated: 2026-10-08  
License: CC BY 4.0 with a link back

CVE-2026-107382 · Severity: medium · CVSS 5.9 · Published 2026-10-08

MariaDB Connector/Node.js is a database driver for Node.js applications. When connecting to MariaDB with zero-configuration TLS and Ed25519 authentication enabled, a reference error in the authentication code causes an uncaught exception that crashes the entire client process. An attacker on the network who can intercept the connection can trigger this crash, causing a denial of service against long-running services.

Technologies: [Mariadb Connector/Node.js](https://junglewise.ai/threats/technologies/connector-node-js), [mariadb (npm)](https://junglewise.ai/threats/technologies/npm-mariadb). Vendors: [Mariadb](https://junglewise.ai/threats/vendors/mariadb), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-107382 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107382 being exploited in the wild.

**How severe is CVE-2026-107382?** Medium severity, with a CVSS score of 5.9, published 8 October 2026.

**Which products and versions are affected?** Mariadb Connector/Node.js before 3.5.4; mariadb (npm) >= 3.3.0, < 3.5.4, SEMVER:introduced=3.3.0,fixed=3.5.4.

**Is there a fix for CVE-2026-107382?** Yes. mariadb (npm): upgrade to 3.5.4 or later. Until then: Provide the server certificate to the client via `ssl.ca` to enable standard certificate validation instead of fingerprint validation, set `ssl.rejectUnauthorized: false` to opt into trust mode, or use an authentication plugin other than `client_ed25519` until upgraded. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107382 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-107382?** Check whether you run Mariadb Connector/Node.js or mariadb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mariadb (npm): upgrade to 3.5.4 or later

  ```sh
  npm install mariadb@3.5.4
  ```


Provide the server certificate to the client via `ssl.ca` to enable standard certificate validation instead of fingerprint validation, set `ssl.rejectUnauthorized: false` to opt into trust mode, or use an authentication plugin other than `client_ed25519` until upgraded.

## Technical details

The Ed25519PasswordAuth.hash() method references an undefined `seed` variable that exists only in a different method's scope, causing a ReferenceError when the fingerprint validation code path is exercised during zero-config TLS connections. This exception occurs synchronously within the socket data handler with no error handling between the packet stream and the plugin, allowing it to escape as an uncaught exception. The vulnerability requires the server to be reached over TCP, `ssl: true` or `ssl` object without `rejectUnauthorized: false`, a password configured, no custom CA certificate provided, and `client_ed25519` as the negotiated authentication plugin.

## Affected products

- MariaDB Connector/Node.js before 3.5.4

## Identifiers

- CVE-2026-107382
- GHSA-cx2f-j9fh-8g68

## Timeline

- 2026-10-08: disclosed

## Related threats

- [MariaDB Connector/Node.js SQL injection in text protocol with NO_BACKSLASH_ESCAPES](https://junglewise.ai/threats/cve-2026-107385-mariadb-connector-node-js-sql-injection-in-the-text-protocol)
- [MariaDB Connector/Node.js SQL injection in SET expansion with permitSetMultiParamEntries](https://junglewise.ai/threats/cve-2026-107384-mariadb-connector-node-js-sql-injection-through-object-keys-in)
- [MariaDB Connector/Node.js heap memory leak in GeoJSON encoding](https://junglewise.ai/threats/cve-2026-107383-mariadb-connector-node-js-exposes-uninitialized-process-memory)
- [MariaDB Connector/Node.js SQL injection in Buffer parameter escaping](https://junglewise.ai/threats/cve-2026-55855-mariadb-connector-node-js-sql-injection-in-buffer-parameter)
- [MariaDB Connector/Node.js cleartext password transmission in PAM authentication](https://junglewise.ai/threats/cve-2026-55854-mariadb-connector-node-js-cleartext-password-transmission-in-pam)