📦 Update dependency mysql2 to v3.22.0 [SECURITY] - #3110

Open

renovate[bot] wants to merge 1 commit into

mainfrom

renovate/npm-mysql2-vulnerability

renovate Bot commented Sep 2, 2026

Contributor

This PR contains the following updates:

Package	Change	Age	Confidence
mysql2 (source)	`3.11.3` → `3.22.0`

See all other Renovate PRs on the Dependency Dashboard

MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials

GHSA-3f6p-5ww8-9rcr

More information

Details

Summary

A rogue MySQL server (or MITM) can force mysql2 to send credentials in plaintext by requesting an auth switch to mysql_clear_password. The driver complies without verifying that TLS is active.

Details

mysql_clear_password is registered as a default standard plugin in lib/commands/auth_switch.js (line 21). When a server sends an AuthSwitchRequest (0xFE) requesting mysql_clear_password, the driver executes it without checking for TLS. The plugin (lib/auth_plugins/mysql_clear_password.js) returns Buffer.from(password + '\0').

Note: caching_sha2_password plugin DOES check for SSL before sending cleartext (line 77). But mysql_clear_password has no such guard.

Attack Scenario

Attacker operates rogue MySQL server or performs MITM
Server advertises caching_sha2_password in handshake
Client sends hashed auth response
Server replies with AuthSwitchRequest to mysql_clear_password
Client sends password in plaintext
Attacker captures plaintext password

PoC

Rogue MySQL server (Node.js, ~80 lines) that captures plaintext passwords from mysql2 clients. Tested against mysql2 3.20.0. Full PoC available on request.

Suggested Fix

Remove mysql_clear_password from standardAuthPlugins, or add a guard requiring TLS/unix socket before allowing cleartext auth.

Impact

mysql2: 9M weekly downloads
Any application connecting without TLS is vulnerable to credential theft
Cloud environments with untrusted network paths are especially at risk

Severity

CVSS Score: 8.2 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

sidorares/node-mysql2 (mysql2)

`v3.22.0`

Features

disable mysql_clear_password plugin by default (#4236) (884bec5), closes #1617
implement COM_RESET_CONNECTION with pool integration (#4148) (49a64cc)

Performance Improvements

defer Error object creation to error handlers in promise wrappers (#4257) (ab131de)

`v3.21.1`

Bug Fixes

limit client flags to server capabilities (#4227) (e1930b8)
use Number.isSafeInteger for supportBigNumbers boundary check (#4225) (295264b)

`v3.21.0`

Features

add support for query attributes (#4223) (d732f78)
types: export ExecuteValues and QueryValues from entry point (9fafd6f)

`v3.20.0`

Features

add TracingChannel support for native APM instrumentation (#4178) (c06afc2)

Bug Fixes

explicitly specify in auth plugins (#4175) (#4187) (5ac5563)
prevent double release from corrupting the connection pool (#4186) (7e57db6)
restore PoolConnection as subclass of Connection (#4183) (97855a6)

`v3.19.1`

Bug Fixes

bound null-terminated string read to packet end (fixes a potential OOB read reported by Doruk Tan Ozturk (peaktwilight)) (#4161) (91c5229)
handle malformed geometry payloads (fixes a potential DoS vulnerability reported by Doruk Tan Ozturk (peaktwilight)) (#4164) (1869215)
prevent query param override of URL-defined connection options (fixes a potential config injection vulnerability reported by Doruk Tan Ozturk (peaktwilight)) (#4162) (3123b4e)
validate buffer bounds in geometry parser (fixes a potential DoS vulnerability reported by Doruk Tan Ozturk (peaktwilight)) (#4159) (7c2ae00)

`v3.19.0`

Features

use server's preferred auth method to eliminate auth switch roundtrip (#4140) (b57c671)

Bug Fixes

fix precision loss for large decimal values (#4135) (099beea)

`v3.18.2`

Bug Fixes

types: add supportBigNumbers, bigNumberStrings, dateStrings, and timezone options to QueryOptions (#4127) (b274e72)
types: extend QueryValues to callback-based methods (#4129) (2ad5f0b)
types: improve ExecuteValues "nested" params (#4133) (3f94950)
types: support Raw and Uint8Array params (#4132) (bde9aec)

`v3.18.1`

Bug Fixes

types: ensure optional params in query and execute methods (#4123) (3f4bbca)

`v3.18.0`

Features

add Symbol.dispose and Symbol.asyncDispose support for Connections, Pools, and Pool Clusters (#4112) (1e612dc)

`v3.17.5`

Bug Fixes

add missing charset encoding for UTF8MB4_0900_BIN (#3855) (c9a0dcd)
deps: include @types/node as a peer dependency (#4108) (5f8ac97)
fix wrong length number write to packet (#3177) (0e06e02)
pool: resolve potential memory leak (#4111) (8aa2052)

`v3.17.4`

Bug Fixes

types for query values (#3985) (a9c8d09)

`v3.17.3`

Bug Fixes

fix PoolConnection.end callback and promise resolution (#3937) (18ff2c6)

`v3.17.2`

Bug Fixes

distinguish delimiters in queries from SQL comments (#4084) (454ba10)
pool: discard connection on error 1290 (Aurora read-only failure) (#4075) (9188963)
pool: handle all read-only errors during Aurora failover (#4082) (ce98d8e)

`v3.17.1`

Bug Fixes

expand object params after ON DUPLICATE KEY UPDATE preceded by SET (#4076) (4d2b930)

`v3.17.0`

Bug Fixes

security: resolve a potential SQL injection bypass through objects (#4054) (7f133cc)

`v3.16.3`

Bug Fixes

constants: remove unsupported CLIENT_DEPRECATE_EOF flag from constants (#4033) (46c3f60)

`v3.16.2`

Bug Fixes

types: add missing ConnectionState type to Promise Connection interface (#4034) (2927949)

`v3.16.1`

Bug Fixes

named-placeholders: improve handling of mixed/nested quotes in query parsing (#4011) (3e00cd7)

`v3.16.0`

Features

BaseConnection: add state getter to track connection lifecycle (#3958) (a394487)

`v3.15.3`

Bug Fixes

skip SNI for IP addresses in TLS connection (#3835) (6000eb2)

`v3.15.2`

Bug Fixes

fix sha256_password to work correctly over a TLS connection (#3809) (fb9eae1)

`v3.15.1`

Bug Fixes

typings: missing callback to PoolCluster.end() (#3819) (53a9bc2)

`v3.15.0`

Features

gracefully end pool connections #3148 (#3776) (e72247f)

`v3.14.5`

Bug Fixes

types: restrict StreamOptions.objectMode to true (#3686) (#3784) (c091f1b)

`v3.14.4`

Bug Fixes

destroy connection when stream errors (#3769) (cc34a83)
fix backpressure when using TLS (#1752) (64ea4cd)
stream: resume connection when stream errors or is destroyed (#3775) (9642a1e)

`v3.14.3`

Bug Fixes

resolve parser cache collision with dual typeCast connections (#3644) (ce2ad75)

`v3.14.2`

Bug Fixes

pass columnType to readDateTimeString (#3700) (1ee48cc)

`v3.14.1`

Miscellaneous Chores

release 3.14.1 (9d097f8)

`v3.14.0`

Features

add RegExp support to PoolCluster (#3451) (2d5050d)

`v3.13.0`

Features

disableEval: add static parsers (#3365) (51da653)
support Cloudflare Workers (#2289) (a79253d)

Bug Fixes

PromisePoolCluster.of returns PromisePoolCluster instead of PoolNamespace (#3261) (be22202)
query: support VECTOR packets in static parser (#3379) (603c246)

`v3.12.0`

Features

PoolCluster: restoreNodeTimeout implementation (#3218) (9a38601)

`v3.11.5`

Bug Fixes

1040 datetime fields returned without time part when time is 00:00:00 (#3204) (bded498)
circular dependencies (#3081) (d5a76e6)
Deno v2 requires commonjs type explicitly (#3209) (cdc9415)

`v3.11.4`

Bug Fixes

types: correct TypeCast's Next callback to return unknown (#3129) (401db79)

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.


          📦 Update dependency mysql2 to v3.22.0 [SECURITY]

92849fe

renovate Bot added the Category: Release Calendar label

renovate Bot enabled auto-merge (squash)

September 2, 2026 00:43

renovate-approve Bot approved these changes

View reviewed changes

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Category: Release Calendar