Is CVE-2026-107384 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107384 being exploited in the wild.

How severe is CVE-2026-107384?

High severity, with a CVSS score of 8.1, published 8 October 2026.

Which products and versions are affected?

mariadb (npm) SEMVER:introduced=3.2.0,fixed=3.2.5.

How is CVE-2026-107384 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-107384?

Check whether you run Mariadb Connector/Node.js or mariadb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107384: MariaDB Connector/Node.js SQL injection in SET expansion with permitSetMultiParamEntries

CVE-2026-107384 · Severity: high · CVSS 8.1 · Published 2026-10-08

MariaDB Connector/Node.js is a database driver used by Node.js applications to connect to MariaDB databases. When the non-default permitSetMultiParamEntries option is enabled, an attacker who controls object keys passed to query operations can inject arbitrary SQL code, potentially reading or modifying sensitive columns like passwords or account balances that the application never intended to expose.

Technologies: Mariadb Connector/Node.js, mariadb (npm). Vendors: Mariadb, npm.

Quick answers

Is CVE-2026-107384 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107384 being exploited in the wild.
How severe is CVE-2026-107384?: High severity, with a CVSS score of 8.1, published 8 October 2026.
Which products and versions are affected?: mariadb (npm) SEMVER:introduced=3.2.0,fixed=3.2.5.
Is there a fix for CVE-2026-107384?: Yes. mariadb (npm): upgrade to 3.2.5 or later. Until then: Disable the permitSetMultiParamEntries option (which is off by default), or validate object keys against an allow-list of permitted column names before passing them to query(). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107384 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-107384?: Check whether you run Mariadb Connector/Node.js or mariadb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mariadb (npm): upgrade to 3.2.5 or later
```
npm install mariadb@3.2.5
```

Disable the permitSetMultiParamEntries option (which is off by default), or validate object keys against an allow-list of permitted column names before passing them to query().

Technical details

The vulnerability exists in three code paths that expand objects into SET clauses when permitSetMultiParamEntries is enabled. These paths manually build backtick-quoted column identifiers without escaping special characters in the key, while values are properly escaped. An attacker-controlled key containing a backtick can close the identifier and inject arbitrary SQL. The connector's escapeId function exists and correctly handles backticks, but was not called from these three sites, leaving them vulnerable to SQL injection.

Affected products

MariaDB Connector/Node.js

Identifiers

CVE-2026-107384
GHSA-v6pj-gxxw-phfw

Timeline

2026-10-08: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.