Junglewise Threat Intelligence

MySQL2 unbounded zlib inflate decompression bomb

Severity: medium · CVSS 5.9 · Published 2026-08-31

Executive brief

The MySQL2 Node.js library fails to limit decompressed packet sizes when compression is enabled, allowing an attacker controlling or intercepting a database connection to send a small packet that expands to gigabytes in memory, causing the client application to crash via out-of-memory. This affects applications using the `compress: true` option on non-TLS connections or when connected to a compromised server.

Technical details

The vulnerability exists in `lib/compressed_protocol.js` in the `handleCompressedPacket()` function, which calls `zlib.inflate(body)` without setting a `maxOutputLength` option. Node.js zlib defaults `maxOutputLength` to `Number.MAX_SAFE_INTEGER`, allowing unbounded decompression. DEFLATE compression can achieve ratios exceeding 1000:1 on crafted input (e.g., 500 MB of zeros compressed to ~500 KB), so a single malicious compressed packet can expand to multiple gigabytes. An attacker with control over or a man-in-the-middle position on a non-TLS MySQL connection can send this packet after successful authentication, causing the client's Node.js process to allocate memory until OOM-kill or crash—no database query is required. The fix is to pass `{ maxOutputLength: MAX_INFLATED_PACKET_SIZE }` to `zlib.inflate()`, causing it to abort with `ERR_BUFFER_TOO_LARGE` if the decompressed size exceeds the cap, routing into the existing error handler. Version 3.23.1 includes the patch.

Affected products

  • sidorares mysql2 <= 3.23.0

Timeline

  • 2026-07-19: disclosed: Published to GitHub Advisory Database (GHSA-rgwj-5xj2-c3m3)
  • 2026-08-31: advisory: Advisory updated on GitHub Advisory Database
  • 2026-07-19: patched: Fixed in mysql2 v3.23.1

References

Related threats