Junglewise Threat Intelligence

MySQL2 auth plugin downgrade to mysql_clear_password leaks credentials

Severity: medium · CVSS 4 · Published 2026-09-01

Executive brief

MySQL2 is a popular Node.js library for connecting to MySQL databases with approximately 9 million weekly downloads. A vulnerability allows a rogue MySQL server or network attacker to force the driver to send database credentials in plaintext by switching the authentication method to mysql_clear_password, even when TLS is not active. This allows attackers to capture plaintext passwords during database connection establishment, putting any application using MySQL2 without encryption at risk of credential theft.

Technical details

The vulnerability is an authentication plugin downgrade attack (CWE-522: Insufficiently Protected Credentials). The mysql_clear_password plugin is registered as a default standard plugin in lib/commands/auth_switch.js (line 21). When a server sends an AuthSwitchRequest (0xFE) packet requesting mysql_clear_password, the driver executes the switch without verifying TLS is active. The vulnerable plugin in lib/auth_plugins/mysql_clear_password.js returns the password in plaintext (Buffer.from(password + '\0')). An attacker can operate a rogue MySQL server or perform a man-in-the-middle attack: the server advertises caching_sha2_password in the handshake, the client sends a hashed response, the server replies with AuthSwitchRequest to mysql_clear_password, and the client sends the plaintext password which the attacker captures. The fix, released in version 3.22.0, disables the mysql_clear_password plugin by default and requires explicit opt-in via enableCleartextPlugin: true in connection options.

Affected products

  • npm mysql2 <3.22.0

Timeline

  • 2026-09-01: disclosed: GHSA-3f6p-5ww8-9rcr published
  • 2026-04-10: patched: Fix released in mysql2 v3.22.0 disabling mysql_clear_password plugin by default

References

Related threats