Is CVE-2026-107385 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107385 being exploited in the wild.

How severe is CVE-2026-107385?

High severity, with a CVSS score of 7.4, published 8 October 2026.

Which products and versions are affected?

mariadb (npm) SEMVER:introduced=0,fixed=3.2.5.

Is there a fix for CVE-2026-107385?

Yes. mariadb (npm): upgrade to 3.2.5 or later. Until then: Use execute() or batch() methods instead of text protocol queries, or disable NO_BACKSLASH_ESCAPES until upgraded. [{"kind": "disclosed", "at": "2026-10-08"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-107385 attacked?

It is attacked over the network.

Am I affected by CVE-2026-107385?

Check whether you run Mariadb Connector/Node.js or mariadb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107385: MariaDB Connector/Node.js SQL injection in text protocol with NO_BACKSLASH_ESCAPES

CVE-2026-107385 · Severity: high · CVSS 7.4 · Published 2026-10-08

MariaDB Connector/Node.js is a driver that applications use to query MariaDB databases. When a database session has NO_BACKSLASH_ESCAPES enabled, the connector fails to escape quote characters correctly, allowing SQL injection attacks through standard query parameters. An attacker can execute arbitrary SQL commands with the database user's privileges, potentially reading, modifying, or deleting sensitive data.

Technologies: Mariadb Connector/Node.js, mariadb (npm). Vendors: Mariadb, npm.

Quick answers

Is CVE-2026-107385 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107385 being exploited in the wild.
How severe is CVE-2026-107385?: High severity, with a CVSS score of 7.4, published 8 October 2026.
Which products and versions are affected?: mariadb (npm) SEMVER:introduced=0,fixed=3.2.5.
Is there a fix for CVE-2026-107385?: Yes. mariadb (npm): upgrade to 3.2.5 or later. Until then: Use execute() or batch() methods instead of text protocol queries, or disable NO_BACKSLASH_ESCAPES until upgraded.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-08"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107385 attacked?: It is attacked over the network.
Am I affected by CVE-2026-107385?: Check whether you run Mariadb Connector/Node.js or mariadb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mariadb (npm): upgrade to 3.2.5 or later
```
npm install mariadb@3.2.5
```

Use execute() or batch() methods instead of text protocol queries, or disable NO_BACKSLASH_ESCAPES until upgraded.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-08"}]

Technical details

The connector's text protocol escaping routines always escaped quotes with backslashes but never checked the server's NO_BACKSLASH_ESCAPES status flag, causing improper escaping when this SQL mode is active. Under NO_BACKSLASH_ESCAPES, quotes must be doubled instead of backslash-escaped; the connector's incorrect escaping closes the string literal prematurely, allowing SQL injection through query parameters including Connection.escape(). The binary prepared-statement and bulk protocols (execute() and batch()) are unaffected.

Affected products

MariaDB Connector/Node.js

Identifiers

CVE-2026-107385
GHSA-r3rv-jm3r-62q2

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.