ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-107383

MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters

Published Oct 8, 2026 · catalog updated Oct 16, 2026 · MariaDB Connector/Node.js exposes uninitialized

Check if you run it

No confirmed exploitation is on record for CVE-2026-107383. EPSS is 0.39%. Act only if a listed version of MariaDB Connector/Node.js exposes uninitialized is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (MariaDB Connector/Node.js exposes uninitialized).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High7.5
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.39%
Remediation
Advisory link
Affected products
npm mariadb

### Description When encoding a GeoJSON Polygon or MultiPolygon parameter for the binary protocol, the connector sized its output buffer from the length property of each ring, then wrote each ring only if it was a real array. The two loops disagreed: any non-array ring carrying a numeric length (a string, or an object such as {"length": 4000}) still reserved 4 + 16 * length bytes, but wrote none of them. The buffer came from Buffer.allocUnsafe() and was returned in full regardless of how far the write position had advanced, so every reserved-but-unwritten byte was uninitialized Node.js heap. The sibling LineString case handled this correctly, aborting with null on the first malformed point, so no reserved byte could escape unwritten. The only gate on this path is value.type naming a GeoJSON type, so any object shaped like {"type": "Polygon", ...} reached the encoder. ### Impact An application that passes an attacker-influenced object as a parameter to execute() or batch() writes uninitialized process memory into the database, where it is readable by anyone who can read that row and persists into backups and replicas. Applications accepting GeoJSON for map or location features are the natural case, as the attacker controls coordinates directly. The disclosed memory is not scoped to the requesting user: in a shared Node.js process the heap may hold other users' request and response bodies, session tokens and cookies, database credentials and TLS key material. The leak is silent — the insert succeeds and the column simply holds more bytes than it should. No non-default connector option and no particular server configuration are required. query() is not affected: the text encoder builds geometry as strings rather than through Buffer.allocUnsafe(). ### Resolution Both the Polygon and MultiPolygon encoders now reject a non-array ring before reserving space for it, so no byte of the allocation can be left uninitialized by the writing loop, matching the existing LineString

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • npm mariadb0 → 3.2.5
  • npm mariadb3.3.0 → 3.3.4
  • npm mariadb3.4.0 → 3.4.7
  • npm mariadb3.5.0-rc.0 → 3.5.4

How to fix CVE-2026-107383

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-107383. EPSS is 0.39%. Act only if a listed version of MariaDB Connector/Node.js exposes uninitialized is installed.

Which versions are affected?

Compare what you have installed with 0 → 3.2.5, 3.3.0 → 3.3.4, 3.4.0 → 3.4.7, 3.5.0-rc.0 → 3.5.4. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-200: Exposure of Sensitive Information. EPSS 0.39%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 8, 2026 · GitHub Advisory Database

    Detected

    ### Description When encoding a GeoJSON Polygon or MultiPolygon parameter for the binary protocol, the connector sized its output buffer from the length property of each ring, then wrote each ring only if it was a real array. The two loops disagreed: any non-array ring carrying a numeric length (a string, or an object such as {"length": 4000}) still reserved 4 + 16 * length bytes, but wrote none o

  2. Oct 16, 2026 · GitHub Advisory Database

    Fix available

    mariadb fixed in 3.2.5; mariadb fixed in 3.3.4; mariadb fixed in 3.4.7; mariadb fixed in 3.5.4

  3. Oct 16, 2026 · GitHub Advisory Database

    Fix available

    mariadb fixed in 3.2.5

  4. Oct 16, 2026 · GitHub Advisory Database

    Fix available

    mariadb fixed in 3.3.4

  5. Oct 16, 2026 · GitHub Advisory Database

    Fix available

    mariadb fixed in 3.4.7

  6. Oct 16, 2026 · GitHub Advisory Database

    Fix available

    mariadb fixed in 3.5.4

  7. Oct 16, 2026 · GitHub Advisory Database

    Updated

    ### Description When encoding a GeoJSON Polygon or MultiPolygon parameter for the binary protocol, the connector sized its output buffer from the length property of each ring, then wrote each ring only if it was a real array. The two loops disagreed: any non-array ring carrying a numeric length (a string, or an object such as {"length": 4000}) still reserved 4 + 16 * length bytes, but wrote none o

Sources

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.