# CVE-2026-107385: MariaDB Connector/Node.js SQL injection in text protocol with NO_BACKSLASH_ESCAPES

Source: https://junglewise.ai/threats/cve-2026-107385-mariadb-connector-node-js-sql-injection-in-the-text-protocol  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-08. Updated: 2026-10-08  
License: CC BY 4.0 with a link back

CVE-2026-107385 · Severity: high · CVSS 7.4 · Published 2026-10-08

MariaDB Connector/Node.js is a driver that applications use to query MariaDB databases. When a database session has NO_BACKSLASH_ESCAPES enabled, the connector fails to escape quote characters correctly, allowing SQL injection attacks through standard query parameters. An attacker can execute arbitrary SQL commands with the database user's privileges, potentially reading, modifying, or deleting sensitive data.

Technologies: [Mariadb Connector/Node.js](https://junglewise.ai/threats/technologies/connector-node-js), [mariadb (npm)](https://junglewise.ai/threats/technologies/npm-mariadb). Vendors: [Mariadb](https://junglewise.ai/threats/vendors/mariadb), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-107385 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107385 being exploited in the wild.

**How severe is CVE-2026-107385?** High severity, with a CVSS score of 7.4, published 8 October 2026.

**Which products and versions are affected?** mariadb (npm) SEMVER:introduced=0,fixed=3.2.5.

**Is there a fix for CVE-2026-107385?** Yes. mariadb (npm): upgrade to 3.2.5 or later. Until then: Use execute() or batch() methods instead of text protocol queries, or disable NO_BACKSLASH_ESCAPES until upgraded.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-08"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107385 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-107385?** Check whether you run Mariadb Connector/Node.js or mariadb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mariadb (npm): upgrade to 3.2.5 or later

  ```sh
  npm install mariadb@3.2.5
  ```


Use execute() or batch() methods instead of text protocol queries, or disable NO_BACKSLASH_ESCAPES until upgraded.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-08"}]

## Technical details

The connector's text protocol escaping routines always escaped quotes with backslashes but never checked the server's NO_BACKSLASH_ESCAPES status flag, causing improper escaping when this SQL mode is active. Under NO_BACKSLASH_ESCAPES, quotes must be doubled instead of backslash-escaped; the connector's incorrect escaping closes the string literal prematurely, allowing SQL injection through query parameters including Connection.escape(). The binary prepared-statement and bulk protocols (execute() and batch()) are unaffected.

## Affected products

- MariaDB Connector/Node.js

## Identifiers

- CVE-2026-107385
- GHSA-r3rv-jm3r-62q2

## Related threats

- [MariaDB Connector/Node.js SQL injection in SET expansion with permitSetMultiParamEntries](https://junglewise.ai/threats/cve-2026-107384-mariadb-connector-node-js-sql-injection-through-object-keys-in)
- [MariaDB Connector/Node.js heap memory leak in GeoJSON encoding](https://junglewise.ai/threats/cve-2026-107383-mariadb-connector-node-js-exposes-uninitialized-process-memory)
- [MariaDB Connector/Node.js uncaught exception in Ed25519 authentication with zero-config TLS](https://junglewise.ai/threats/cve-2026-107382-mariadb-connector-node-js-uncaught-exception-crashes-the-client)
- [MariaDB Connector/Node.js SQL injection in Buffer parameter escaping](https://junglewise.ai/threats/cve-2026-55855-mariadb-connector-node-js-sql-injection-in-buffer-parameter)
- [MariaDB Connector/Node.js cleartext password transmission in PAM authentication](https://junglewise.ai/threats/cve-2026-55854-mariadb-connector-node-js-cleartext-password-transmission-in-pam)