CVE-2026-55855: MariaDB Connector/Node.js SQL Injection

CVE-2026-55855 Overview

CVE-2026-55855 is a SQL injection vulnerability in MariaDB Connector/Node.js, the client library that connects Node.js applications to MariaDB and MySQL databases. The flaw affects Buffer parameter escaping when the client character set is big5, gbk, sjis, cp932, or gb18030. Client-side escape logic in PacketOutputStream.writeBufferEscape inserts a 0x5C backslash without applying charset-aware multibyte recognition, allowing an attacker-controlled lead byte to consume the escape and leave a 0x27 quote unescaped. This terminates the string literal and permits arbitrary SQL execution. The issue is fixed in versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3. The default utf8mb4 character set and binary prepared statements are not affected.

Critical Impact
Successful exploitation allows an attacker to inject arbitrary SQL statements, exposing or modifying any data accessible to the database account used by the application.

Affected Products

MariaDB Connector/Node.js versions prior to 3.2.4 in the 3.2.x branch
MariaDB Connector/Node.js versions prior to 3.3.3, 3.4.6, and 3.5.3 in the 3.3.x, 3.4.x, and 3.5.x branches
Applications using client character sets big5, gbk, sjis, cp932, or gb18030 with Buffer parameters

Discovery Timeline

2026-08-28 - CVE-2026-55855 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-55855

Vulnerability Analysis

The vulnerability is a classic multibyte-encoding SQL injection [CWE-89] in the client-side escape routine of MariaDB Connector/Node.js. When a Buffer parameter is serialized into a text-protocol query, PacketOutputStream.writeBufferEscape in lib/io/packet-output-stream.js scans the buffer byte-by-byte and prepends 0x5C before each single-quote or backslash. This escape pass does not consult character-set metadata. Under multibyte encodings whose trail-byte range overlaps 0x5C, the resulting wire sequence can be reinterpreted by the server lexer.

Root Cause

The MariaDB server's SQL lexer applies my_ismbchar before escape processing. When the connection uses big5, gbk, sjis, cp932, or gb18030, an attacker-controlled lead byte pairs with the inserted 0x5C backslash to form a valid multibyte character. The server consumes both bytes as one character, leaving the following 0x27 quote unescaped. The quote then closes the string literal, and any bytes that follow are parsed as SQL. The execute binary prepared-statement path avoids text-protocol escaping and is not affected.

Attack Vector

An attacker supplies binary content in an application input that is later passed as a Buffer parameter to a query. The connection must use one of the vulnerable client character sets. Exploitation requires the application to accept binary or raw byte input and to be configured with a non-default charset, which raises attack complexity.

javascript

// Patch: lib/io/packet-output-stream.js (MariaDB commit 25c6239)
 const Utils = require('../misc/utils');
 const Errors = require('../misc/errors');
 const Collations = require('../const/collations');
+const { getMbRecognizer } = require('../misc/charset-mb');
 
 const QUOTE = 0x27;
 const DBL_QUOTE = 0x22;

// New file: lib/misc/charset-mb.js introduces per-charset multibyte recognizers
// used by PacketOutputStream#writeBufferEscape to avoid splitting a valid
// multibyte character with an inserted escape byte.
const big5 = {
  isHead: (b) => b >= 0xa1 && b <= 0xfe,
  length: (buf, i, n) => {
    if (i + 1 >= n) return 0;
    const t = buf[i + 1];
    return (t >= 0x40 && t <= 0x7e) || (t >= 0xa1 && t <= 0xfe) ? 2 : 0;
  }
};

const gbk = {
  isHead: (b) => b >= 0x81 && b <= 0xfe,
  // length: (buf, i, n) => { ... }
};
// Source: https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/25c6239b68fd909132355c3f8535a5ef32423468

Detection Methods for CVE-2026-55855

Indicators of Compromise

Unexpected SQL statements in database query logs originating from application accounts, particularly containing terminated string literals followed by additional SQL keywords
Application error logs showing SQL syntax errors correlated with binary input fields
Connections that issue SET NAMES big5, gbk, sjis, cp932, or gb18030 from Node.js application hosts

Detection Strategies

Inventory Node.js applications using mariadb npm package and identify installed versions below 3.2.4, 3.3.3, 3.4.6, or 3.5.3
Audit connection configuration for non-default charset values matching the vulnerable set
Enable MariaDB and MySQL general or audit logging and search for anomalous multi-statement queries or unusual byte sequences preceding quote characters

Monitoring Recommendations

Monitor database accounts used by Node.js services for query patterns that deviate from application baselines
Alert on database schema reads (information_schema) or privilege queries originating from application-tier accounts
Track outbound data volumes from database servers to detect exfiltration following successful injection

How to Mitigate CVE-2026-55855

Immediate Actions Required

Upgrade mariadb Node.js connector to 3.2.4, 3.3.3, 3.4.6, or 3.5.3 depending on the deployed branch
Switch database connections to the default utf8mb4 character set where feasible
Migrate queries that pass Buffer parameters to the binary prepared-statement execute path, which is not affected

Patch Information

Fixes are available in MariaDB Connector/Node.js releases 3.2.4, 3.3.3, 3.4.6, and 3.5.3. The patches introduce a new lib/misc/charset-mb.js module providing per-charset multibyte recognizers that PacketOutputStream.writeBufferEscape consults before inserting escape bytes. See the MariaDB Security Advisory GHSA-g5xc-5w98-jfvm and tracking issue CONJS-350.

Workarounds

Set the connection character set to utf8mb4 in the connector configuration until the patch can be applied
Use the execute binary prepared-statement API rather than the text-protocol query API when passing Buffer values
Validate and reject non-UTF-8 or binary input at the application boundary for endpoints that must run on legacy character sets

bash

# Upgrade the MariaDB Node.js connector to a fixed release
npm install mariadb@3.5.3

# Or pin to the fixed version in package.json for older branches
# "mariadb": "3.4.6"  // for 3.4.x deployments
# "mariadb": "3.3.3"  // for 3.3.x deployments
# "mariadb": "3.2.4"  // for 3.2.x deployments

# Verify the installed version
npm ls mariadb