CVE-2026-55855: MariaDB Connector/Node.js SQL injection in Buffer parameter escaping

CVE-2026-55855 · Severity: medium · CVSS 6.5 · Published 2026-08-28

MariaDB Connector/Node.js is a database driver used by Node.js applications to connect to MariaDB databases. The connector has a flaw in how it escapes binary data when using certain multi-byte character sets, allowing an attacker who can control binary parameter values to break out of the intended SQL string and execute arbitrary SQL commands. This could lead to unauthorized access to sensitive data or modification of database contents.

Technologies: Mariadb Connector/Node.js, mariadb (npm). Vendors: Mariadb, npm.

Quick answers

Is CVE-2026-55855 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55855 being exploited in the wild.
How severe is CVE-2026-55855?
Medium severity, with a CVSS score of 6.5, published 28 August 2026.
Which products and versions are affected?
Mariadb Connector/Node.js < 3.2.4, >= 3.3.0 and < 3.3.3, >= 3.4.0 and < 3.4.6, >= 3.5.0 and < 3.5.3; mariadb (npm) SEMVER:introduced=0,fixed=3.2.4.
Is there a fix for CVE-2026-55855?
Yes. mariadb (npm): upgrade to 3.2.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55855 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-55855?
Check whether you run Mariadb Connector/Node.js or mariadb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mariadb (npm): upgrade to 3.2.4 or later
    npm install mariadb@3.2.4

Technical details

The vulnerability is a multi-byte character set escape bypass in the connector's client-side parameter binding logic. When binding Buffer (binary) parameters, the connector escapes quote (0x27) and backslash (0x5C) bytes by inserting a backslash prefix. However, under multi-byte charsets where the trail-byte range includes 0x5C (big5, gbk, sjis, cp932, gb18030), an attacker-controlled lead byte followed by the escape backslash is interpreted by the server's SQL lexer as a single multi-byte character, consuming the escape backslash as the trail byte. This leaves the following quote unescaped, terminating the string literal and allowing SQL injection. The attack requires: (1) use of an affected charset (not the default utf8mb4), (2) untrusted data in a Buffer parameter, and (3) client-side parameter binding (not server-side prepared statements). Patches are available in versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3.

Affected products

  • MariaDB Connector/Node.js < 3.2.4, >= 3.3.0 and < 3.3.3, >= 3.4.0 and < 3.4.6, >= 3.5.0 and < 3.5.3

Identifiers

  • CVE-2026-55855
  • GHSA-g5xc-5w98-jfvm

Timeline

  • 2026-08-28: disclosed: GitHub Security Advisory GHSA-g5xc-5w98-jfvm published
  • 2026-08-28: patched: Patches released in versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.