CVE-2026-107384: MariaDB Connector/Node.js SQL Injection

CVE-2026-107384 Overview

CVE-2026-107384 is a SQL injection vulnerability [CWE-89] in MariaDB Connector/Node.js, the client library that connects Node.js applications to MariaDB and MySQL databases. The flaw affects versions from 3.2.0 up to 3.2.5, 3.3.4, 3.4.7, and 3.5.4 when applications enable the permitSetMultiParamEntries option. Object keys expanded into a SQL SET clause bypass the escapeId sanitization routine. An attacker who controls a key value can inject arbitrary SQL that executes with the database user's privileges.

Critical Impact
Attacker-controlled object keys can modify unintended columns and append arbitrary SQL statements, enabling data tampering, unauthorized disclosure, and potential compromise of database integrity.

Affected Products

MariaDB Connector/Node.js versions 3.2.0 through 3.2.4
MariaDB Connector/Node.js versions 3.3.0 through 3.3.3
MariaDB Connector/Node.js versions 3.4.0 through 3.4.6 and 3.5.0 through 3.5.3

Discovery Timeline

2026-10-08 - CVE-2026-107384 published to NVD
2026-10-09 - Last updated in NVD database

Technical Details for CVE-2026-107384

Vulnerability Analysis

The vulnerability stems from improper handling of object keys passed to the SQL SET clause builder when permitSetMultiParamEntries is enabled. The connector wrapped user-supplied keys in backticks without escaping embedded backticks. An attacker-controlled key containing a backtick character closes the quoted identifier early, allowing the remainder of the key to be parsed as SQL. The database then executes the injected statements under the authenticated connection's privileges.

Applications that pass objects directly from untrusted sources — such as HTTP request bodies — into queries using this option are directly exploitable. Serialized-object handling used when the option is disabled is not affected. The default configuration disables permitSetMultiParamEntries, which limits exposure to applications that explicitly opted in.

Root Cause

In lib/cmd/query.js and lib/misc/utils.js, the connector constructed identifiers using string concatenation: '`' + key + '`'. No escapeId routine existed to double embedded backticks. The fix introduces a TextEncoder.escapeId static method that replaces every backtick with a doubled backtick before quoting the identifier.

Attack Vector

Exploitation requires that a vulnerable application accept untrusted object keys and pass them to a query using the multi-parameter SET syntax. The attack is network-reachable and requires no authentication to the application layer, though the attacker must influence the object keys reaching the connector.

javascript

// Patch from commit 144b8f4ef29539a9fb4b75d972b9dcdac4088b4e
// lib/cmd/encoder/text-encoder.js
class TextEncoder {
  /**
   * Escape an identifier, doubling any backtick it contains.
   *
   * Object keys expanded by permitSetMultiParamEntries become column
   * names, so a key holding a backtick would otherwise close the
   * identifier and let the rest of the key be parsed as SQL.
   */
  static escapeId(value) {
    return '`' + value.replace(/`/g, '``') + '`';
  }
}

// lib/cmd/query.js — before vs after
// -  out.writeString('`' + key + '`');
// +  out.writeString(TextEncoder.escapeId(key));

Source: MariaDB Commit 144b8f4

Detection Methods for CVE-2026-107384

Indicators of Compromise

Database query logs containing unexpected backtick characters (`) within column identifier positions of SET clauses.
Unexplained updates to columns outside the application's documented write surface, especially privilege or role columns.
Application code paths that reference permitSetMultiParamEntries: true combined with user-controlled object inputs.

Detection Strategies

Audit the Node.js codebase for the permitSetMultiParamEntries option and trace every call site that constructs a query object from external input.
Enable MariaDB and MySQL general query log or audit plugin to capture full statement text for review against baseline application queries.
Review web application firewall (WAF) and reverse proxy logs for POST or PUT bodies containing backtick characters in JSON keys.

Monitoring Recommendations

Alert on database sessions executing multiple statements per request from Node.js application accounts that normally issue single statements.
Track schema access patterns per service account and flag writes to tables or columns the service does not legitimately use.
Monitor dependency manifests (package.json, package-lock.json) for mariadb connector versions below the patched releases.

How to Mitigate CVE-2026-107384

Immediate Actions Required

Upgrade mariadb connector to version 3.2.5, 3.3.4, 3.4.7, or 3.5.4 depending on your release branch.
Audit application code for permitSetMultiParamEntries and disable it where it is not strictly required.
Validate and allowlist object keys before passing them into query builders that interpolate them as identifiers.

Patch Information

MariaDB Corporation released fixes in Release 3.2.5, Release 3.3.4, Release 3.4.7, and Release 3.5.4. The patches add a TextEncoder.escapeId routine that doubles embedded backticks before quoting identifiers. See the MariaDB Security Advisory GHSA-v6pj-gxxw-phfw and tracking ticket CONJS-369 for complete details.

Workarounds

Disable permitSetMultiParamEntries in connector configuration until the upgrade is deployed; the option is disabled by default.
Reject object keys that contain backtick characters at the application input validation layer.
Use parameterized queries with explicit column lists instead of passing arbitrary objects into SET clauses.

bash

# Upgrade the MariaDB connector to a patched release
npm install mariadb@3.5.4 --save

# Verify installed version
npm ls mariadb

# Audit code for the vulnerable option
grep -r "permitSetMultiParamEntries" ./src