CVE-2024-21507

CVE-2024-21507 affects the mysql2 npm package: all versions before 3.9.3 are vulnerable due to improper input validation in the keyFromFields function, allowing cache poisoning via a colon (:) inside an attacker-crafted key value. Impact is described as confidentiality/integrity concerns in vario...

CVE-2024-21509

The CVE-2024-21509 vulnerability affects the mysql2 package prior to version 3.9.4, as described across multiple sources. The root cause is Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through parserFn in text_parser.js and binary_parser....