CVE-2026-107382

Name of the Vulnerable Software and Affected Versions MariaDB Connector/Node.js versions 3.3.0 through 3.5.3

Description A denial of service issue exists in the zero-configuration TLS fingerprint-validation path. When the connector validates a server's identity via Authentication.validateFingerPrint, it calls the Ed25519PasswordAuth.hash() function. This function references a seed identifier that is not in scope, resulting in a synchronous ReferenceError. Because this error occurs within the socket data handler and is not caught, it triggers an uncaught exception that terminates the Node.js client process.

This can be triggered by a legitimate server, a malicious server, or a network attacker presenting a self-signed certificate. Exploitation requires a MariaDB server reached over TCP, TLS enabled (via ssl: true or an ssl object where rejectUnauthorized is not false), a set password, no ssl.ca configured, and the client ed25519 authentication plugin negotiated.

Recommendations Update to version 3.5.4 or later. As a temporary workaround, provide the server certificate to the client using ssl: { ca: ... } to enable standard certificate validation. As a temporary workaround, set ssl: { rejectUnauthorized: false } to enable trust mode. As a temporary workaround, use an authentication plugin other than client ed25519.