CVE-2026-107383: MariaDB Connector/Node.js Information Disclosure

CVE-2026-107383 Overview

CVE-2026-107383 is an information disclosure vulnerability in the MariaDB Connector/Node.js driver. The flaw resides in the GeoJSON Polygon and MultiPolygon binary encoders inside lib/cmd/encoder/binary-encoder.js. Prior to versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4, the encoder sizes a Buffer.allocUnsafe() allocation using each ring's numeric length property before confirming the ring is an array. A malformed non-array ring reserves bytes that the writing loop never overwrites, causing the connector to transmit uninitialized Node.js heap memory to the database via execute() or batch(). The persisted bytes may include other users' data, session tokens, database credentials, or TLS key material.

Critical Impact
Uninitialized Node.js heap memory is written into database values and may propagate to backups and replicas, exposing credentials, session material, and TLS keys.

Affected Products

MariaDB Connector/Node.js versions prior to 3.2.5 (3.2.x branch)
MariaDB Connector/Node.js versions prior to 3.3.4 and 3.4.7
MariaDB Connector/Node.js versions prior to 3.5.4

Discovery Timeline

2026-10-08 - CVE-2026-107383 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-107383

Vulnerability Analysis

The defect is an Information Exposure issue classified under [CWE-200]. The GeoJSON binary encoders handle Polygon and MultiPolygon geometry types by iterating over coordinate rings. For each ring, the encoder reads the length property to allocate a buffer sized to hold the ring's binary representation. The allocation uses Buffer.allocUnsafe(), which does not zero-initialize memory and returns raw heap bytes.

If the ring is not an array but exposes a numeric length property, allocation succeeds while the subsequent write loop skips the invalid entry. The unwritten bytes remain populated with whatever residual data occupied that heap region. The connector then transmits the full buffer in a prepared statement, where the server persists it as a column value. The text-protocol query() path does not use these binary encoders and is unaffected.

Root Cause

The root cause is missing input validation combined with unsafe memory allocation. The encoder trusts attacker-controlled or malformed input shape before type-checking the ring, and Buffer.allocUnsafe() provides no backing-memory guarantees. The fix adds an early if (value == null) return null; guard and tightens validation inside the Polygon and MultiPolygon branches.

Attack Vector

An attacker who can influence GeoJSON payloads submitted to an application using the vulnerable connector can craft a Polygon or MultiPolygon with a non-array ring that exposes a length property. When the application invokes execute() or batch(), uninitialized heap bytes are written into the target database column. Repeated submissions let the attacker harvest heap contents containing credentials, tokens, or private keys over time.

javascript

// Patch from lib/cmd/encoder/binary-encoder.js
    let geoBuff;
    let pos;
    let type;
+   if (value == null) return null;
    if (!headerType) {
      switch (value.type) {
        case 'Point':
// Source: https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/2314c03b785db482599d2befd06f4992e5fc46b3

Detection Methods for CVE-2026-107383

Indicators of Compromise

Database columns typed as GEOMETRY, POLYGON, or MULTIPOLYGON containing binary values that fail to deserialize as valid Well-Known Binary (WKB).
Unexpected high-entropy byte sequences in geometry columns that resemble PEM headers, JWTs, or ASCII credential fragments.
Application logs showing GeoJSON insertions with non-standard ring structures or object-shaped rings exposing length.

Detection Strategies

Audit application code and dependency manifests (package.json, package-lock.json) for mariadb connector versions below 3.2.5, 3.3.4, 3.4.7, or 3.5.4.
Scan existing geometry columns for malformed WKB and compare row sizes against expected ring counts to spot oversized allocations.
Review query logs for INSERT or UPDATE statements against geometry columns originating from user-supplied GeoJSON.

Monitoring Recommendations

Enable prepared-statement logging on MariaDB and MySQL servers to retain binary parameter payloads for forensic analysis.
Monitor outbound replica and backup streams for anomalous geometry payload sizes that may indicate propagation of leaked heap data.
Alert on application exceptions arising from GeoJSON parsing in the connector, which may indicate exploitation attempts.

How to Mitigate CVE-2026-107383

Immediate Actions Required

Upgrade MariaDB Connector/Node.js to version 3.2.5, 3.3.4, 3.4.7, or 3.5.4 depending on the deployed branch.
Rotate any secrets, session tokens, API keys, and TLS private keys that resided in the Node.js process memory of affected applications.
Audit database geometry columns and purge or sanitize suspicious values before they propagate to backups or replicas.

Patch Information

The fix is published in the following releases: MariaDB Connector Release 3.2.5, 3.3.4, 3.4.7, and 3.5.4. See the MariaDB Security Advisory GHSA-48qf-xh34-q73r and the tracking ticket MariaDB JIRA Issue CONJS-367 for full details.

Workarounds

Validate GeoJSON input at the application layer to ensure every ring is a true array before passing values to execute() or batch().
Where upgrade is not immediately feasible, route geometry inserts through the text-protocol query() path, which is not affected.
Restrict and sanitize untrusted sources of GeoJSON input and reject objects that are not plain arrays for coordinates rings.

bash

# Upgrade the connector to a patched version
npm install mariadb@3.5.4
# or pin to the appropriate patched branch
npm install mariadb@3.4.7
npm install mariadb@3.3.4
npm install mariadb@3.2.5