CVE-2026-55855

Name of the Vulnerable Software and Affected Versions MariaDB Connector/Node.js versions prior to 3.2.4 MariaDB Connector/Node.js versions prior to 3.3.3 MariaDB Connector/Node.js versions prior to 3.4.6 MariaDB Connector/Node.js versions prior to 3.5.3

Description SQL injection is possible when the connector escapes Buffer parameters client-side using specific multi-byte client character sets: big5, gbk, sjis, cp932, or gb18030. The issue occurs because the PacketOutputStream.writeBufferEscape() function in lib/io/packet-output-stream.js escapes bytes without using charset-aware logic. An attacker can provide a lead byte that the server's SQL lexer treats as a valid multi-byte character, consuming the inserted 0x5C backslash as a trail byte. This leaves the subsequent 0x27 quote unescaped, allowing the attacker to terminate the string literal and execute arbitrary SQL. This can lead to unauthorized exposure or modification of data. The default utf8mb4 character set and parameters sent via the execute binary prepared-statement path are not affected.

Recommendations Update to version 3.2.4 or newer for the 3.2.x branch. Update to version 3.3.3 or newer for the 3.3.x branch. Update to version 3.4.6 or newer for the 3.4.x branch. Update to version 3.5.3 or newer for the 3.5.x branch. Use server-side prepared statements to ensure parameters are bound via the binary protocol instead of being escaped into the SQL text. Avoid passing untrusted data as Buffer parameters when using the affected character sets.