0perator (>=0.1.0, <=0.3.0), @0xchain/telemetry (>=0.0.1, <=1.1.0-beta.8) +3057 more potentially affected by CVE-2026-104872 via @opentelemetry/instrumentation-mysql2 (>=0.26.0, <=0.66.0)

@opentelemetry/instrumentation-mysql2 NPM version =0.26.0, =0.1.0, =0.0.1, =3.11.1, =0.0.53, =0.0.31, =0.8.0, =0.1.0, =1.0.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.3.702, =0.0.65, =0.2.0, =0.2.0, =0.0.1, =0.0.5 and more Source cves: CVE-2026-104872 Source advisory:...

Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute

Impact Multiple @opentelemetry/instrumentation- packages recorded the database connection username as the db.user span attribute on every instrumented database operation. This attribute was emitted unconditionally — it was not gated by enhancedDatabaseReporting or any other opt-in flag, and it wa...

ruby:4.0 security update

ruby 4.0.6-35 - Fix resolv: do not register on-demand classes for unknown DNS types and SvcParamKeys to prevent memory exhaustion CVE-2026-80212 Resolves: RHEL-252035 4.0.6-34 - Upgrade to Ruby 4.0.6. Resolves: RHEL-211301 Resolves: RHEL-193663 4.0.3-33 - Fix Net::IMAP ResponseReader quadratic...

CLSA-2026-1790622749 TuxCare security update for mysql2 (2 CVEs)

TuxCare rebuilt mysql2 to address 2 CVEs. Fixed in 3.20.0-tuxcare.1...

ruby:4.0 security update

An update is available for rubygem-mysql2, module.rubygem-mysql2, module.ruby, ruby, rubygem-pg, module.rubygem-pg. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE li...

ROOT-APP-NPM-GHSA-3F6P-5WW8-9RCR GHSA-3f6p-5ww8-9rcr in mysql2 - Patched by Root

Root has patched GHSA-3f6p-5ww8-9rcr in the mysql2 package for Root:npm. Multiple fixed versions available...

ruby:3.3 security update

An update is available for rubygem-mysql2, module.rubygem-mysql2, module.ruby, ruby, rubygem-abrt, rubygem-pg, module.rubygem-pg, module.rubygem-abrt. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

ROOT-APP-NPM-CVE-2024-21512 CVE-2024-21512 in mysql2 - Patched by Root

Root has patched CVE-2024-21512 in the mysql2 package for Root:npm. Multiple fixed versions available...

PT-2026-98209

Root has patched GHSA-3f6p-5ww8-9rcr in the mysql2 package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2024-21508 CVE-2024-21508 in mysql2 - Patched by Root

Root has patched CVE-2024-21508 in the mysql2 package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2024-21511 CVE-2024-21511 in mysql2 - Patched by Root

Root has patched CVE-2024-21511 in the mysql2 package for Root:npm. Multiple fixed versions available...

NPM: MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials

NPM: MySQL2: Auth Plugin Downgrade to mysqlclearpassword Leaks Plaintext Credentials vulnerability discovered by ? in WordPress Npm mysql2 versions 3.22.0...

Insufficiently Protected Credentials

Overview mysql2 is a mostly API compatible with mysqljs and supports majority of features. Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the authSwitchRequest handling in lib/commands/authswitch.js and the direct auth path in...

@142vip/egg (>=0.0.1-alpha.5, <=0.0.1-alpha.6), @142vip/egg-grpc-client (0.0.1-alpha.4) +503 more potentially affected by unknown CVE via mysql2 (>=3.0.0, <=3.21.1)

mysql2 NPM version =3.0.0, =0.0.1-alpha.5, =0.0.1-alpha.4, =0.0.1-alpha.1, =4.2.3, =15.0.0, =0.2.0, =0.1.0, =0.10.0, =1.0.0, =0.0.27, =1.0.43, =1.6.0, =1.6.5 - @alexop/express-mysql-session 2.2.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-3F6P-5WW8-9RCR...

@142vip/egg (>=0.0.1-alpha.5, <=0.0.1-alpha.6), @142vip/egg-grpc-client (0.0.1-alpha.4) +503 more potentially affected by unknown CVE via mysql2 (>=3.0.0, <=3.21.1)

mysql2 NPM version =3.0.0, =0.0.1-alpha.5, =0.0.1-alpha.4, =0.0.1-alpha.1, =4.2.3, =15.0.0, =0.2.0, =0.1.0, =0.10.0, =1.0.0, =0.0.27, =1.0.43, =1.6.0, =1.6.5 - @alexop/express-mysql-session 2.2.0 and more Source cves: unknown CVE Source advisory: SNYK:JS-MYSQL2-19498545...

GHSA-3F6P-5WW8-9RCR MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials

Summary A rogue MySQL server or MITM can force mysql2 to send credentials in plaintext by requesting an auth switch to mysqlclearpassword. The driver complies without verifying that TLS is active. Details mysqlclearpassword is registered as a default standard plugin in lib/commands/authswitch.js...

MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials

Summary A rogue MySQL server or MITM can force mysql2 to send credentials in plaintext by requesting an auth switch to mysqlclearpassword. The driver complies without verifying that TLS is active. Details mysqlclearpassword is registered as a default standard plugin in lib/commands/authswitch.js...

Insufficiently Protected Credentials

Overview org.webjars.npm:mysql2 is a mostly API compatible with mysqljs and supports majority of features. Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the authSwitchRequest handling in lib/commands/authswitch.js and the direct auth path in...

CLSA-2026-1788255454 TuxCare security update for mysql2 (1 CVE)

TuxCare rebuilt mysql2 to address 1 CVE. Fixed in 2.3.3-tuxcare.6...

PT-2026-85144

Summary A rogue MySQL server or MITM can force mysql2 to send credentials in plaintext by requesting an auth switch to mysql clear password. The driver complies without verifying that TLS is active. Details mysql clear password is registered as a default standard plugin in lib/commands/auth...