@alancode95/core-prisma (1.0.0), @aliceo2/bookkeeping (>=0.27.0, <=1.20.0) +118 more potentially affected by CVE-2026-55215 via mariadb (>=3.0.0, <=3.5.2)

mariadb NPM version =3.0.0, =0.27.0, =1.14.0, =0.1.0, =0.1.0, =1.0.70, =2.0.0, =0.0.1, =1.0.0-alpha.0, =1.0.0, =0.3.3, =0.4.0, =0.0.6, =0.5.0-beta.7, =0.5.0 and more Source cves: CVE-2026-55215 Source advisory: SNYK:JS-MARIADB-19432138...

@aliceo2/infologger (>=1.16.0, <=1.18.0) potentially affected by CVE-2026-55215 via mariadb (3.5.2)

mariadb NPM version 3.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on mariadb and may be impacted: - @aliceo2/infologger =1.16.0, =1.18.0 Source cves: CVE-2026-55215 Source advisory: OSV:GHSA-CQHC-2H57-WPXF...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the authentication. An attacker can intercept sensitive credentials by performing a man-in-the-middle attack during the initial handshake. Note: This is only exploitable if SSL/TLS is enabled...

MariaDB's connector leaks the cleartext password to an MitM despite `ssl: true`

Summary When SSL/TLS is enabled but no CA / server certificate is provided, the connector verifies the server's identity using fingerprint validation. The check is effective, the connection is ultimately rejected when it fails, but it happens after the authentication exchange. As a result, the...

NPM: MariaDB's connector leaks the cleartext password to an MitM despite `ssl: true`

NPM: MariaDB's connector leaks the cleartext password to an MitM despite ssl: true vulnerability discovered by ? in WordPress Npm mariadb versions 3.2.4...

@alancode95/core-prisma (1.0.0), @aliceo2/infologger (>=1.15.0, <=1.15.1) +39 more potentially affected by CVE-2026-55215 via mariadb (>=3.4.0, <=3.4.5)

mariadb NPM version =3.4.0, =1.15.0, =1.0.0, =0.3.3, =0.4.0, =0.5.0-beta.7, =2.105.0, =1.0.0, =6.3.14-dev.35, =0.2.1, =6.11.0-dev.20, =1.2.1, =2.1.0, =0.61.0, =0.93.0, =0.112.0 and more Source cves: CVE-2026-55215 Source advisory: OSV:GHSA-CQHC-2H57-WPXF...

GHSA-CQHC-2H57-WPXF MariaDB's connector leaks the cleartext password to an MitM despite `ssl: true`

Summary When SSL/TLS is enabled but no CA / server certificate is provided, the connector verifies the server's identity using fingerprint validation. The check is effective, the connection is ultimately rejected when it fails, but it happens after the authentication exchange. As a result, the...

@aliceo2/infologger (1.14.0), @azimutt/connector-mariadb (>=0.1.0, <=0.1.9) +7 more potentially affected by CVE-2026-55215 via mariadb (>=3.3.0, <=3.3.2)

mariadb NPM version =3.3.0, =0.1.0, =0.1.0, =6.1.13-dev.2, =1.0.0, =0.1.0, =0.1.39 - nodefony 7.0.0 Source cves: CVE-2026-55215 Source advisory: OSV:GHSA-CQHC-2H57-WPXF...

CVE-2026-55215 MariaDB Connector/Node.js: Connector leaks the cleartext password to an MitM despite `ssl: true`

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to versions 3.3.3, 3.4.6, and 3.5.3, when ssl is enabled without a pinned CA or server certificate, MariaDB Connector/Node.js sends credentials before completing certificate...

CVE-2026-55215 MariaDB Connector/Node.js: Connector leaks the cleartext password to an MitM despite `ssl: true`

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to versions 3.3.3, 3.4.6, and 3.5.3, when ssl is enabled without a pinned CA or server certificate, MariaDB Connector/Node.js sends credentials before completing certificate...

CVE-2026-55215 MariaDB Connector/Node.js: Connector leaks the cleartext password to an MitM despite `ssl: true`

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to versions 3.3.3, 3.4.6, and 3.5.3, when ssl is enabled without a pinned CA or server certificate, MariaDB Connector/Node.js sends credentials before completing certificate...

CVE-2026-55215

MariaDB Connector/Node.js is vulnerable to cleartext password disclosure via a man-in-the-middle attack when ssl: true is set without a pinned CA or server certificate. The root cause lies in the TLS handshake logic: in handshake.js, a server selecting mysql_clear_password as the initial authenti...

EUVD-2026-67869

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to versions 3.3.3, 3.4.6, and 3.5.3, when ssl is enabled without a pinned CA or server certificate, MariaDB Connector/Node.js sends credentials before completing certificate...

PT-2026-83375

Name of the Vulnerable Software and Affected Versions MariaDB Connector/R2DBC versions prior to 1.4.1 Description The driver encodes and decodes all character data assuming the connection character set is UTF-8. A server can announce a mid-session change to the character set client variable throu...

PT-2026-83374

Name of the Vulnerable Software and Affected Versions MariaDB Connector/J versions prior to 2.7.14 MariaDB Connector/J versions prior to 3.3.5 MariaDB Connector/J versions prior to 3.4.3 MariaDB Connector/J versions prior to 3.5.9 Description The connector encodes and decodes protocol text and...

CVE-2026-55859: Improper Encoding or Escaping of Output

MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb encodes and decodes all character data under the assumption that the connection character set is UTF-8. A server can announce a mid-session change to charactersetclien...

CVE-2026-55856: Insufficiently Protected Credentials

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, when a Java application connects with sslMode=verify-full or sslMode=verify-ca, supplies a password, and does not configure serverSslCert or trustStore,...

PT-2026-83237

Name of the Vulnerable Software and Affected Versions MariaDB Connector/Node.js versions prior to 3.2.4 MariaDB Connector/Node.js versions 3.3.0 through 3.3.2 MariaDB Connector/Node.js versions 3.4.0 through 3.4.5 MariaDB Connector/Node.js versions 3.5.0 through 3.5.2 Description When SSL is...

CVE-2026-55854: Cleartext Transmission of Sensitive Information

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js can disclose an account password when PAM dialog authentication is negotiated over an insecure transport. In...

CVE-2026-55215: Improper Certificate Validation

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to versions 3.3.3, 3.4.6, and 3.5.3, when ssl is enabled without a pinned CA or server certificate, MariaDB Connector/Node.js sends credentials before completing certificate...