chore(deps): update dependency mysql2 to v3.23.1 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
mysql2 (source)	3.15.1 → 3.23.1

---

MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials

GHSA-3f6p-5ww8-9rcr

More information

Details

Summary

A rogue MySQL server (or MITM) can force mysql2 to send credentials in plaintext by requesting an auth switch to mysql_clear_password. The driver complies without verifying that TLS is active.

Details

mysql_clear_password is registered as a default standard plugin in lib/commands/auth_switch.js (line 21). When a server sends an AuthSwitchRequest (0xFE) requesting mysql_clear_password, the driver executes it without checking for TLS. The plugin (lib/auth_plugins/mysql_clear_password.js) returns Buffer.from(password + '\0').

Note: caching_sha2_password plugin DOES check for SSL before sending cleartext (line 77). But mysql_clear_password has no such guard.

Attack Scenario

1. Attacker operates rogue MySQL server or performs MITM
2. Server advertises caching_sha2_password in handshake
3. Client sends hashed auth response
4. Server replies with AuthSwitchRequest to mysql_clear_password
5. Client sends password in plaintext
6. Attacker captures plaintext password

PoC

Rogue MySQL server (Node.js, ~80 lines) that captures plaintext passwords from mysql2 clients. Tested against mysql2 3.20.0. Full PoC available on request.

Suggested Fix

Remove mysql_clear_password from standardAuthPlugins, or add a guard requiring TLS/unix socket before allowing cleartext auth.

Impact

• mysql2: 9M weekly downloads
• Any application connecting without TLS is vulnerable to credential theft
• Cloud environments with untrusted network paths are especially at risk

Severity

• CVSS Score: 8.2 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/sidorares/node-mysql2/security/advisories/GHSA-3f6p-5ww8-9rcr
• https://github.com/sidorares/node-mysql2/issues/1617
• https://github.com/sidorares/node-mysql2/pull/4236
• https://github.com/sidorares/node-mysql2/commit/884bec56288d827939d0dd3f1f4ae476fbc8dbeb
• https://github.com/sidorares/node-mysql2/releases/tag/v3.22.0
• https://github.com/advisories/GHSA-3f6p-5ww8-9rcr

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS

GHSA-rgwj-5xj2-c3m3

More information

Details

Vulnerability Details

File: lib/compressed_protocol.js
Line: 43 (zlib.inflate(body, (err, data) => { ... }) inside handleCompressedPacket)

Root Cause

When a connection is created with compress: true (and the server advertises CLIENT_COMPRESS), every incoming packet is unwrapped by handleCompressedPacket() in lib/compressed_protocol.js, which calls:

zlib.inflate(body, (err, data) => { ... });

No options object (in particular, no maxOutputLength) is passed. Node's zlib convenience methods default maxOutputLength to buffer.kMaxLength, which on this platform is Number.MAX_SAFE_INTEGER — i.e. effectively unbounded until the process runs out of memory. The 3-byte "length of payload before compression" field in the compressed-packet header is read (packet.readInt24()) but is only used to branch on !== 0; it is never used to cap or validate the actual inflate output size, and the real decompressed size is determined purely by the attacker-supplied deflate stream.

Because DEFLATE can reach compression ratios over 1000:1 for crafted repetitive input, an attacker who controls (or MITMs, on a non-TLS connection) the MySQL server endpoint can send a single small compressed packet that expands to gigabytes in the client's memory — a classic decompression-bomb / "zip bomb" applied to MySQL's client-compression protocol.

Attack Scenario

1. Application connects with mysql2/mysql2/promise using compress: true (a documented option for reducing bandwidth, commonly used for cloud/WAN DB connections).
2. The connection target is attacker-controlled or attacker-compromised, or an attacker MITMs a non-TLS connection.
3. Right after authentication succeeds, the malicious endpoint sends one crafted compressed packet whose deflate stream is small on the wire (hundreds of KB) but decompresses to several GB.
4. zlib.inflate() starts allocating memory for the full decompressed output with no ceiling.
5. The Node.js process's RSS grows uncontrolled until OOM-kill or crash — no query needs to be issued by the client; the malicious packet alone is enough.

Impact

Denial of Service of the client application (process crash / OOM) — not the database itself. No authentication bypass or data exposure. Requires compress: true plus a malicious/compromised server or MITM position.

Vulnerable Code

function handleCompressedPacket(packet) {
  const connection = this;
  const deflatedLength = packet.readInt24();
  const body = packet.readBuffer();

  if (deflatedLength !== 0) {
    connection.inflateQueue.push((task) => {
      zlib.inflate(body, (err, data) => {
        if (err) {
          connection._handleNetworkError(err);
          return;
        }
        connection._bumpCompressedSequenceId(packet.numPackets);
        connection._inflatedPacketsParser.execute(data);
        task.done();
      });
    });
  } else {
    ...
  }
}

Recommended Fix

const MAX_INFLATED_PACKET_SIZE = 1 * 1024 * 1024 * 1024; // e.g. 1 GiB, ideally configurable

zlib.inflate(body, { maxOutputLength: MAX_INFLATED_PACKET_SIZE }, (err, data) => {
  if (err) {
    connection._handleNetworkError(err);
    return;
  }
  ...
});

maxOutputLength makes zlib.inflate abort with ERR_BUFFER_TOO_LARGE as soon as the decompressed size would exceed the cap, routing into the exact same (already-existing) err → connection._handleNetworkError(err) path, so no new error-handling logic is required.

Verification

Dynamically confirmed on v3.23.0 (HEAD) using a minimal rogue "MySQL server" built on node-mysql2's own server-mode helpers (mysql.createServer, Packets.Handshake, connection.writeOk()). The rogue server completes a real handshake advertising CLIENT_COMPRESS, then writes one raw compressed frame (509,604 bytes on the wire — a zlib deflate of 500 MB of zero bytes, ratio 1028.8:1) directly to the socket. A normal mysql.createConnection({ ..., compress: true }) victim client — which never issues any query — had its RSS grow from 74.3 MB to 1115.0 MB after receiving that single packet, before erroring out with PROTOCOL_UNEXPECTED_PACKET once the client tried to parse the inflated zero-filled buffer as MySQL packets. The memory allocation happens unconditionally before any content validation.

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/sidorares/node-mysql2/security/advisories/GHSA-rgwj-5xj2-c3m3
• https://github.com/sidorares/node-mysql2/commit/7c48343c95ecc80d30d6ebfa67875947b7d848d2
• https://github.com/sidorares/node-mysql2/releases/tag/v3.23.1
• https://github.com/advisories/GHSA-rgwj-5xj2-c3m3

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

sidorares/node-mysql2 (mysql2)

v3.23.1

Compare Source

Bug Fixes

• security: fix unbounded decompression of server-supplied compressed packets, reported by alanturing881 (7c48343)
• parser: call typeCast for NULL values in the binary protocol (#​4394) (01f1092)

v3.23.0

Compare Source

Features

• return unsafe integers inside JSON columns as exact strings with supportBigNumbers (#​4388) (a26ff14)
• sql-escaper: add Temporal support when escaping values (#​4392) (6b933f6)
• support MariaDB data types (UUID, INET4, INET6, VECTOR, JSON) via extended type metadata; run CI against MariaDB (#​4373) (5034e57)

v3.22.6

Compare Source

Bug Fixes

• sql-escaper: resolve multi statement and expand object regressions (#​4380) (1b927a9)

v3.22.5

Compare Source

Bug Fixes

• keep 00:00:00 time for TIMESTAMP in binary protocol with dateStrings (#​4327) (2af33a1)

v3.22.4

Compare Source

Bug Fixes

• pool: reject queued requests on end (#​4291) (fbff09c)

v3.22.3

Compare Source

Bug Fixes

• allow resetOnRelease in connection config validation (#​4278) (e72f923)

v3.22.2

Compare Source

Bug Fixes

• promise: point rejection stacks at caller for promise API (#​4267) (c79a3f3)

v3.22.1

Compare Source

Bug Fixes

• async stack traces not pointing to correct source, regression introduced by #​4257 (#​4265) (5b6206c)
• packet: return INVALID_DATE for zero dates with numeric timezone offset (#​1019) (#​4258) (cb5adcc)

v3.22.0

Compare Source

Features

• disable mysql_clear_password plugin by default (#​4236) (884bec5), closes #​1617
• implement COM_RESET_CONNECTION with pool integration (#​4148) (49a64cc)

Performance Improvements

• defer Error object creation to error handlers in promise wrappers (#​4257) (ab131de)

v3.21.1

Compare Source

Bug Fixes

• limit client flags to server capabilities (#​4227) (e1930b8)
• use Number.isSafeInteger for supportBigNumbers boundary check (#​4225) (295264b)

v3.21.0

Compare Source

Features

• add support for query attributes (#​4223) (d732f78)
• types: export ExecuteValues and QueryValues from entry point (9fafd6f)

v3.20.0

Compare Source

Features

• add TracingChannel support for native APM instrumentation (#​4178) (c06afc2)

Bug Fixes

• explicitly specify in auth plugins (#​4175) (#​4187) (5ac5563)
• prevent double release from corrupting the connection pool (#​4186) (7e57db6)
• restore PoolConnection as subclass of Connection (#​4183) (97855a6)

v3.19.1

Compare Source

Bug Fixes

• bound null-terminated string read to packet end (fixes a potential OOB read reported by Doruk Tan Ozturk (peaktwilight)) (#​4161) (91c5229)
• handle malformed geometry payloads (fixes a potential DoS vulnerability reported by Doruk Tan Ozturk (peaktwilight)) (#​4164) (1869215)
• prevent query param override of URL-defined connection options (fixes a potential config injection vulnerability reported by Doruk Tan Ozturk (peaktwilight)) (#​4162) (3123b4e)
• validate buffer bounds in geometry parser (fixes a potential DoS vulnerability reported by Doruk Tan Ozturk (peaktwilight)) (#​4159) (7c2ae00)

v3.19.0

Compare Source

Features

• use server's preferred auth method to eliminate auth switch roundtrip (#​4140) (b57c671)

Bug Fixes

• fix precision loss for large decimal values (#​4135) (099beea)

v3.18.2

Compare Source

Bug Fixes

• types: add supportBigNumbers, bigNumberStrings, dateStrings, and timezone options to QueryOptions (#​4127) (b274e72)
• types: extend QueryValues to callback-based methods (#​4129) (2ad5f0b)
• types: improve ExecuteValues "nested" params (#​4133) (3f94950)
• types: support Raw and Uint8Array params (#​4132) (bde9aec)

v3.18.1

Compare Source

Bug Fixes

• types: ensure optional params in query and execute methods (#​4123) (3f4bbca)

v3.18.0

Compare Source

Features

• add Symbol.dispose and Symbol.asyncDispose support for Connections, Pools, and Pool Clusters (#​4112) (1e612dc)

v3.17.5

Compare Source

Bug Fixes

• add missing charset encoding for UTF8MB4_0900_BIN (#​3855) (c9a0dcd)
• deps: include @types/node as a peer dependency (#​4108) (5f8ac97)
• fix wrong length number write to packet (#​3177) (0e06e02)
• pool: resolve potential memory leak (#​4111) (8aa2052)

v3.17.4

Compare Source

Bug Fixes

• types for query values (#​3985) (a9c8d09)

v3.17.3

Compare Source

Bug Fixes

• fix PoolConnection.end callback and promise resolution (#​3937) (18ff2c6)

v3.17.2

Compare Source

Bug Fixes

• distinguish delimiters in queries from SQL comments (#​4084) (454ba10)
• pool: discard connection on error 1290 (Aurora read-only failure) (#​4075) (9188963)
• pool: handle all read-only errors during Aurora failover (#​4082) (ce98d8e)

v3.17.1

Compare Source

Bug Fixes

• expand object params after ON DUPLICATE KEY UPDATE preceded by SET (#​4076) (4d2b930)

v3.17.0

Compare Source

Bug Fixes

• security: resolve a potential SQL injection bypass through objects (#​4054) (7f133cc)

v3.16.3

Compare Source

Bug Fixes

• constants: remove unsupported CLIENT_DEPRECATE_EOF flag from constants (#​4033) (46c3f60)

v3.16.2

Compare Source

Bug Fixes

• types: add missing ConnectionState type to Promise Connection interface (#​4034) (2927949)

v3.16.1

Compare Source

Bug Fixes

• named-placeholders: improve handling of mixed/nested quotes in query parsing (#​4011) (3e00cd7)

v3.16.0

Compare Source

Features

• BaseConnection: add state getter to track connection lifecycle (#​3958) (a394487)

v3.15.3

Compare Source

Bug Fixes

• skip SNI for IP addresses in TLS connection (#​3835) (6000eb2)

v3.15.2

Compare Source

Bug Fixes

• fix sha256_password to work correctly over a TLS connection (#​3809) (fb9eae1)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.