GHSA-rgwj-5xj2-c3m3

Medium

Published: —Translated: 14/09/2026(UTC)NVD NIST

Summary

A vulnerability in mysql2 (in lib/compressed_protocol.js, line 43) where zlib.inflate is used to decompress packets. When a connection is created with compress: true and the server advertises CLIENT_COMPRESS, each incoming packet is decompressed without limits, potentially leading to excessive memory usage or DoS.

Risk Assessment

A malicious MySQL server could send crafted compressed packets causing excessive resource consumption on the client (DoS).

Recommendation

Update mysql2 to a patched version and consider disabling connection compression if not required.

Other vulnerabilities in mysql2

GHSA-3f6p-5ww8-9rcrHigh
A rogue MySQL server (or a man-in-the-middle) can force mysql2 to send credentials in plaintext by requesting an auth switch to mysql_clear_password. The driver complies without verifying that TLS is active.

Original NVD description (English source)

## Vulnerability Details **File**: `lib/compressed_protocol.js` **Line**: 43 (`zlib.inflate(body, (err, data) => { ... })` inside `handleCompressedPacket`) ### Root Cause When a connection is created with `compress: true` (and the server advertises `CLIENT_COMPRESS`), every incoming packet is unwr