Executive brief
MySQL2 is a popular Node.js library for connecting to MySQL databases, with millions of weekly downloads. A rogue or compromised MySQL server can trick the library into sending database credentials in plaintext by requesting a switch to the mysql_clear_password authentication method. Applications connecting without TLS encryption are vulnerable to credential theft through network interception or man-in-the-middle attacks.
Technical details
The mysql_clear_password authentication plugin is enabled by default in mysql2 and is registered as a standard authentication method in lib/commands/auth_switch.js. When a MySQL server sends an AuthSwitchRequest (0xFE) packet requesting mysql_clear_password, the driver executes it without validating that a TLS connection is active, unlike the caching_sha2_password plugin which includes such a check. An attacker operating a rogue MySQL server or performing a man-in-the-middle attack can advertise caching_sha2_password during the initial handshake, accept the client's hashed authentication response, then request a switch to mysql_clear_password. The vulnerable driver will comply and transmit the plaintext password. The vulnerability was fixed in version 3.22.0 by disabling the mysql_clear_password plugin by default and requiring explicit opt-in via the enableCleartextPlugin configuration option or by providing a custom auth plugin.
Affected products
- sidorares mysql2 < 3.22.0
Timeline
- 2026-07-19: disclosed
- 2026-09-01: advisory
- 2026-04-10: patched: Patch released in v3.22.0
References
- https://github.com/sidorares/node-mysql2/security/advisories/GHSA-3f6p-5ww8-9rcr
- https://github.com/sidorares/node-mysql2/issues/1617
- https://github.com/sidorares/node-mysql2/pull/4236
- https://github.com/sidorares/node-mysql2/commit/884bec56288d827939d0dd3f1f4ae476fbc8dbeb
- https://github.com/sidorares/node-mysql2/releases/tag/v3.22.0
- https://api.github.com/repos/sidorares/node-mysql2/security-advisories/GHSA-3f6p-5ww8-9rcr