# CVE-2026-107384: MariaDB Connector/Node.js SQL injection in SET expansion with permitSetMultiParamEntries

Source: https://junglewise.ai/threats/cve-2026-107384-mariadb-connector-node-js-sql-injection-through-object-keys-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-08. Updated: 2026-10-08  
License: CC BY 4.0 with a link back

CVE-2026-107384 · Severity: high · CVSS 8.1 · Published 2026-10-08

MariaDB Connector/Node.js is a database driver used by Node.js applications to connect to MariaDB databases. When the non-default permitSetMultiParamEntries option is enabled, an attacker who controls object keys passed to query operations can inject arbitrary SQL code, potentially reading or modifying sensitive columns like passwords or account balances that the application never intended to expose.

Technologies: [Mariadb Connector/Node.js](https://junglewise.ai/threats/technologies/connector-node-js), [mariadb (npm)](https://junglewise.ai/threats/technologies/npm-mariadb). Vendors: [Mariadb](https://junglewise.ai/threats/vendors/mariadb), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-107384 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107384 being exploited in the wild.

**How severe is CVE-2026-107384?** High severity, with a CVSS score of 8.1, published 8 October 2026.

**Which products and versions are affected?** mariadb (npm) SEMVER:introduced=3.2.0,fixed=3.2.5.

**Is there a fix for CVE-2026-107384?** Yes. mariadb (npm): upgrade to 3.2.5 or later. Until then: Disable the permitSetMultiParamEntries option (which is off by default), or validate object keys against an allow-list of permitted column names before passing them to query(). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107384 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-107384?** Check whether you run Mariadb Connector/Node.js or mariadb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mariadb (npm): upgrade to 3.2.5 or later

  ```sh
  npm install mariadb@3.2.5
  ```


Disable the permitSetMultiParamEntries option (which is off by default), or validate object keys against an allow-list of permitted column names before passing them to query().

## Technical details

The vulnerability exists in three code paths that expand objects into SET clauses when permitSetMultiParamEntries is enabled. These paths manually build backtick-quoted column identifiers without escaping special characters in the key, while values are properly escaped. An attacker-controlled key containing a backtick can close the identifier and inject arbitrary SQL. The connector's escapeId function exists and correctly handles backticks, but was not called from these three sites, leaving them vulnerable to SQL injection.

## Affected products

- MariaDB Connector/Node.js

## Identifiers

- CVE-2026-107384
- GHSA-v6pj-gxxw-phfw

## Timeline

- 2026-10-08: disclosed

## Related threats

- [MariaDB Connector/Node.js SQL injection in text protocol with NO_BACKSLASH_ESCAPES](https://junglewise.ai/threats/cve-2026-107385-mariadb-connector-node-js-sql-injection-in-the-text-protocol)
- [MariaDB Connector/Node.js heap memory leak in GeoJSON encoding](https://junglewise.ai/threats/cve-2026-107383-mariadb-connector-node-js-exposes-uninitialized-process-memory)
- [MariaDB Connector/Node.js uncaught exception in Ed25519 authentication with zero-config TLS](https://junglewise.ai/threats/cve-2026-107382-mariadb-connector-node-js-uncaught-exception-crashes-the-client)
- [MariaDB Connector/Node.js SQL injection in Buffer parameter escaping](https://junglewise.ai/threats/cve-2026-55855-mariadb-connector-node-js-sql-injection-in-buffer-parameter)
- [MariaDB Connector/Node.js cleartext password transmission in PAM authentication](https://junglewise.ai/threats/cve-2026-55854-mariadb-connector-node-js-cleartext-password-transmission-in-pam)