GHSA-3f6p-5ww8-9rcr

High

Published: —Translated: 14/09/2026(UTC)NVD NIST

Summary

A rogue MySQL server (or a man-in-the-middle) can force mysql2 to send credentials in plaintext by requesting an auth switch to mysql_clear_password. The driver complies without verifying that TLS is active.

Risk Assessment

Credential interception by an attacker on the network could lead to unauthorized access to the database.

Recommendation

Update mysql2 to a patched version and ensure that database connections always use TLS with certificate verification.

Other vulnerabilities in mysql2

GHSA-rgwj-5xj2-c3m3Medium
A vulnerability in mysql2 (in lib/compressed_protocol.js, line 43) where zlib.inflate is used to decompress packets. When a connection is created with compress: true and the server advertises CLIENT_COMPRESS, each incoming packet is decompressed without limits, potentially leading to excessive memory usage or DoS.

Original NVD description (English source)

## Summary A rogue MySQL server (or MITM) can force mysql2 to send credentials in **plaintext** by requesting an auth switch to `mysql_clear_password`. The driver complies without verifying that TLS is active. ## Details `mysql_clear_password` is registered as a default standard plugin in `lib/co