DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-55855: CVE-2026-55855: SQL Injection in MariaDB Connector/Node.js via Multi-byte Client Character Sets

#security #cve #cybersecurity

CVE-2026-55855: SQL Injection in MariaDB Connector/Node.js via Multi-byte Client Character Sets

Vulnerability ID: CVE-2026-55855
CVSS Score: 6.5
Published: 2026-08-28

CVE-2026-55855 is a client-side SQL injection vulnerability in the MariaDB Connector/Node.js library that occurs when using legacy multi-byte character sets. The flaw arises from naive, byte-wise client-side parameter escaping. Attackers can leverage specific multi-byte lead bytes to absorb backslash escape characters on the server side, allowing them to terminate string literals and execute arbitrary SQL commands.

TL;DR

A client-side escaping flaw in MariaDB's Node.js driver allows SQL injection when using legacy multi-byte encodings (e.g., GBK, BIG5). Upgrading or switching to utf8mb4 mitigates the issue.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-89 / CWE-116
  • Attack Vector: Network
  • CVSS Severity: 6.5 (Medium)
  • Exploit Status: Proof-of-Concept
  • KEV Status: Not Listed
  • Impact: Client-Side SQL Injection Bypass

Affected Systems

  • mariadb-connector-nodejs
  • mariadb-connector-nodejs: < 3.2.4 (Fixed in: 3.2.4)
  • mariadb-connector-nodejs: >= 3.3.0, < 3.3.3 (Fixed in: 3.3.3)
  • mariadb-connector-nodejs: >= 3.4.0, < 3.4.6 (Fixed in: 3.4.6)
  • mariadb-connector-nodejs: >= 3.5.0, < 3.5.3 (Fixed in: 3.5.3)

Code Analysis

Commit: 0148cad

[misc] Fix possible SQL injection in Buffer parameter escape under big5/gbk/sjis/cp932/gb18030 client charset

Mitigation Strategies

  • Upgrade the mariadb-connector-nodejs package to patched releases.
  • Enforce standard utf8mb4 encoding on the client connection.
  • Use server-side prepared statements via conn.execute() instead of text queries.

Remediation Steps:

  1. Identify vulnerable installations by inspecting package-lock.json for the 'mariadb' dependency.
  2. Run 'npm install mariadb@latest' to resolve dependencies to versions 3.2.4, 3.3.3, 3.4.6, or 3.5.3 depending on the tracking branch.
  3. Modify database connection configurations to default to utf8mb4 rather than legacy encodings.
  4. Refactor usage of conn.query() to conn.execute() for parameterized database queries.

References

Read the full report for CVE-2026-55855 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)