CVE-2026-107385: MariaDB Connector/Node.js SQL Injection

CVE-2026-107385 Overview

CVE-2026-107385 is a SQL injection vulnerability [CWE-89] in the MariaDB Connector/Node.js library. The connector's text-protocol escaping routine always prefixes quote characters with a backslash, ignoring the session's NO_BACKSLASH_ESCAPES SQL mode. When that mode is active, the backslash is treated as a literal character, allowing an attacker-controlled placeholder value to terminate a SQL string literal and inject arbitrary SQL. The injected statements execute with the application's database privileges. The flaw affects Connection.escape() and text-protocol query paths, while execute() and batch() use the binary protocol and are not impacted.

Critical Impact
Attacker-controlled input can escape SQL string literals and execute arbitrary database commands when NO_BACKSLASH_ESCAPES is enabled server-wide, via connector options, or through an application-issued SET sql_mode.

Affected Products

MariaDB Connector/Node.js versions prior to 3.2.5
MariaDB Connector/Node.js 3.3.x prior to 3.3.4
MariaDB Connector/Node.js 3.4.x prior to 3.4.7 and 3.5.x prior to 3.5.4

Discovery Timeline

2026-10-08 - CVE-2026-107385 published to NVD
2026-10-09 - Last updated in NVD database

Technical Details for CVE-2026-107385

Vulnerability Analysis

MariaDB Connector/Node.js connects Node.js applications to MariaDB and MySQL databases. The library offers two query execution paths. The query() function uses the text protocol and relies on client-side escaping. The execute() and batch() functions use the binary protocol with server-side prepared statements.

The text-protocol escaping logic in lib/misc/utils.js unconditionally prepends a backslash to single quotes, double quotes, and backslashes. This assumption breaks when the server session uses the NO_BACKSLASH_ESCAPES SQL mode. Under that mode, the SQL standard applies: a quote inside a string literal is escaped by doubling it, and backslashes carry no special meaning.

Root Cause

The root cause is a missing check for the ServerStatus flag that reflects NO_BACKSLASH_ESCAPES. The escaping function never consults the server's reported mode before building the sanitized string. An attacker supplying a single quote in a placeholder produces output like \', which under the standards-compliant mode leaves the quote unescaped. The literal then closes early and subsequent characters are parsed as SQL.

Attack Vector

Exploitation requires the database session to run with NO_BACKSLASH_ESCAPES enabled. That mode can be set server-wide in the MariaDB configuration, applied through connector initialization options, or issued at runtime through SET sql_mode. Once enabled, any text-protocol query that interpolates attacker-controlled input through Connection.escape() or placeholder substitution becomes injectable. The attacker needs only to control a string parameter reaching such a query to execute SQL with the application's privileges.

javascript

// Patch excerpt from lib/misc/utils.js (CommonJS build)
 const hexArray = '0123456789ABCDEF'.split('');
 const Errors = require('../misc/errors');
 const Iconv = require('iconv-lite');
+const ServerStatus = require('../const/server-status');
 const TextEncoder = require('../cmd/encoder/text-encoder');

Source: MariaDB Connector/Node.js commit 7670d909

The fix imports the ServerStatus constants so the escaping routine can inspect the session's current SQL mode and switch to standards-compliant quote doubling when NO_BACKSLASH_ESCAPES is set.

Detection Methods for CVE-2026-107385

Indicators of Compromise

Database sessions where sql_mode contains NO_BACKSLASH_ESCAPES while applications continue to use Connection.query() or Connection.escape() with user-supplied input.
Query logs showing unexpected statement terminators, stacked queries, or UNION SELECT fragments inside string parameters.
Application errors referencing SQL syntax failures that correlate with inputs containing single quotes.

Detection Strategies

Audit application source for calls to Connection.query(), Connection.escape(), and pool.query() that pass concatenated or placeholder-substituted user input.
Inventory connector configurations and MariaDB server variables for NO_BACKSLASH_ESCAPES in sql_mode, and review any application code that issues SET sql_mode.
Use software composition analysis to flag mariadb npm package versions below 3.2.5, 3.3.4, 3.4.7, and 3.5.4.

Monitoring Recommendations

Enable MariaDB general query logging or audit plugins on sensitive databases and alert on anomalous statement patterns from application accounts.
Correlate web application request logs with database query logs to identify input strings that produce syntactically unusual SQL.
Monitor runtime changes to sql_mode and alert when NO_BACKSLASH_ESCAPES is introduced on previously unaffected sessions.

How to Mitigate CVE-2026-107385

Immediate Actions Required

Upgrade the mariadb Node.js package to 3.2.5, 3.3.4, 3.4.7, or 3.5.4, matching the minor version in use.
Migrate text-protocol calls to execute() or batch(), which use the binary protocol and are not affected by this flaw.
Review MariaDB server and connector configuration and remove NO_BACKSLASH_ESCAPES from sql_mode where it is not required.

Patch Information

The vendor fixed the issue by consulting the server's status flags before escaping string values. Fixed releases are MariaDB Connector 3.2.5, 3.3.4, 3.4.7, and 3.5.4. Full technical context is published in GHSA-r3rv-jm3r-62q2 and tracked as MariaDB JIRA CONJS-368.

Workarounds

Disable NO_BACKSLASH_ESCAPES in the server configuration and prohibit application code from re-enabling it through SET sql_mode.
Replace Connection.query() call sites with Connection.execute() so user input is passed as bound parameters over the binary protocol.
Add input validation that rejects or encodes single quotes before values reach any text-protocol query path.

bash

# Upgrade the vulnerable package to a fixed release
npm install mariadb@3.5.4 --save

# Verify the installed version
npm ls mariadb

# Confirm the database session is not using the vulnerable mode
mysql -e "SELECT @@SESSION.sql_mode;"