# npm mysql information disclosure via uninitialized buffer

Source: https://junglewise.ai/threats/npm-mysql-information-disclosure-via-uninitialized-buffer-7b0e338d  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2019-05-23. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: info · Published 2019-05-23

The Node.js mysql package before version 2.14.0 contains a vulnerability where uninitialized memory is transmitted over the network when a numeric value is provided as a database password. An attacker with control over the password parameter could extract sensitive information from the application's memory. This issue only affects Node.js versions below 6.0.0 due to protective checks added in newer Node.js releases.

Technologies: [mysql (npm)](https://junglewise.ai/threats/technologies/npm-mysql). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 23 May 2019.

**Which products and versions are affected?** mysql (npm) SEMVER:introduced=2.0.0-alpha8,fixed=2.14.0.

**Is there a fix for This vulnerability?** Yes. mysql (npm): upgrade to 2.14.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run mysql (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mysql (npm): upgrade to 2.14.0 or later

  ```sh
  npm install mysql@2.14.0
  ```


## Technical details

The vulnerability is a memory disclosure issue (CWE-201) in the mysql Node.js package affecting versions 2.0.0-alpha8 through 2.13.x. When a numeric value is passed as the password parameter during database connection creation, the affected code allocates a buffer without proper initialization and sends it over the network during the authentication handshake. The vulnerability is triggered only when connecting to MySQL servers and the password parameter is of numeric type rather than a string. Network access to the vulnerable application is required; no authentication is needed from the attacker's perspective. The flaw was fixed in version 2.14.0 by using the safe-buffer module to ensure proper buffer initialization. The vulnerability only manifests in Node.js versions below 6.0.0, as newer versions include runtime protections that throw an error when attempting to create an uninitialized buffer.

## Affected products

- npm mysql 2.0.0-alpha8 through 2.13.x

## Timeline

- 2019-05-23: disclosed

## References

- [https://github.com/mysqljs/mysql/commit/192fe45593ba5768534afb6f2154432ca67a5002](https://github.com/mysqljs/mysql/commit/192fe45593ba5768534afb6f2154432ca67a5002)
- [https://github.com/mysqljs/mysql/commit/310c6a7d1b2e14b63b572dbfbfa10128f20c6d52](https://github.com/mysqljs/mysql/commit/310c6a7d1b2e14b63b572dbfbfa10128f20c6d52)
- [https://github.com/mysqljs/mysql](https://github.com/mysqljs/mysql)
- [https://www.npmjs.com/advisories/602](https://www.npmjs.com/advisories/602)

## Related threats

- [MySQL for Node.js LOAD DATA LOCAL INFILE information disclosure](https://junglewise.ai/threats/cve-2019-14939-mysql-for-node-js-load-data-local-infile-information-disclosure)
- [mysql SQL injection in escape function](https://junglewise.ai/threats/cve-2015-9244-mysql-sql-injection-in-escape-function)