chore(deps): update dependency mysql2 to v3.22.0 [security]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
mysql2 (source)	3.2.0 → 3.22.0

---

mysql2 cache poisoning vulnerability

CVE-2024-21507 / GHSA-mqr2-w7wj-jjgr

More information

Details

Versions of the package mysql2 before 3.9.3 are vulnerable to Improper Input Validation through the keyFromFields function, resulting in cache poisoning. An attacker can inject a colon : character within a value of the attacker-crafted key.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-21507
• https://github.com/sidorares/node-mysql2/pull/2424
• https://github.com/sidorares/node-mysql2/commit/0d54b0ca6498c823098426038162ef10df02c818
• https://blog.slonser.info/posts/mysql2-attacker-configuration
• https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6591300
• https://github.com/advisories/GHSA-mqr2-w7wj-jjgr

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

mysql2 vulnerable to Prototype Poisoning

CVE-2024-21509 / GHSA-49j4-86m8-q2jw

More information

Details

Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through parserFn in text_parser.js and binary_parser.js.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-21509
• https://github.com/sidorares/node-mysql2/pull/2574
• https://github.com/sidorares/node-mysql2/commit/4a964a3910a4b8de008696c554ab1b492e9b4691
• https://blog.slonser.info/posts/mysql2-attacker-configuration
• https://github.com/sidorares/node-mysql2/blob/fd3d117da82cc5c5fa5a3701d7b33ca77691bc61/lib/parsers/text_parser.js%23L134
• https://github.com/sidorares/node-mysql2/releases/tag/v3.9.4
• https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6591084
• https://github.com/advisories/GHSA-49j4-86m8-q2jw

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

mysql2 Remote Code Execution (RCE) via the readCodeFor function

CVE-2024-21508 / GHSA-fpw7-j2hg-69v5

More information

Details

Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the readCodeFor function due to improper validation of the supportBigNumbers and bigNumberStrings values.

Severity

• CVSS Score: 9.8 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-21508
• https://github.com/sidorares/node-mysql2/pull/2572
• https://github.com/sidorares/node-mysql2/commit/74abf9ef94d76114d9a09415e28b496522a94805
• https://blog.slonser.info/posts/mysql2-attacker-configuration
• https://github.com/sidorares/node-mysql2/blob/1609b5393516d72a4ae47196837317fbe75e0c13/lib/parsers/text_parser.js%23L14C10-L14C21
• https://github.com/sidorares/node-mysql2/releases/tag/v3.9.4
• https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6591085
• https://github.com/advisories/GHSA-fpw7-j2hg-69v5

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

MySQL2 for Node Arbitrary Code Injection

CVE-2024-21511 / GHSA-4rch-2fh8-94vw

More information

Details

Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function.

Severity

• CVSS Score: 9.8 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-21511
• https://github.com/sidorares/node-mysql2/pull/2608
• https://github.com/sidorares/node-mysql2/commit/7d4b098c7e29d5a6cb9eac2633bfcc2f0f1db713
• https://github.com/sidorares/node-mysql2/releases/tag/v3.9.7
• https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6670046
• https://github.com/advisories/GHSA-4rch-2fh8-94vw

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

mysql2 vulnerable to Prototype Pollution

CVE-2024-21512 / GHSA-pmh2-wpjm-fj45

More information

Details

Versions of the package mysql2 before 3.9.8 are vulnerable to Prototype Pollution due to improper user input sanitization passed to fields and tables when using nestTables.

Severity

• CVSS Score: 8.2 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-21512
• https://github.com/sidorares/node-mysql2/pull/2702
• https://github.com/sidorares/node-mysql2/commit/efe3db527a2c94a63c2d14045baba8dfefe922bc
• https://gist.github.com/domdomi3/e9f0f9b9b1ed6bfbbc0bea87c5ca1e4a
• https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6861580
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-7176010
• https://github.com/advisories/GHSA-pmh2-wpjm-fj45

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials

GHSA-3f6p-5ww8-9rcr

More information

Details

Summary

A rogue MySQL server (or MITM) can force mysql2 to send credentials in plaintext by requesting an auth switch to mysql_clear_password. The driver complies without verifying that TLS is active.

Details

mysql_clear_password is registered as a default standard plugin in lib/commands/auth_switch.js (line 21). When a server sends an AuthSwitchRequest (0xFE) requesting mysql_clear_password, the driver executes it without checking for TLS. The plugin (lib/auth_plugins/mysql_clear_password.js) returns Buffer.from(password + '\0').

Note: caching_sha2_password plugin DOES check for SSL before sending cleartext (line 77). But mysql_clear_password has no such guard.

Attack Scenario

1. Attacker operates rogue MySQL server or performs MITM
2. Server advertises caching_sha2_password in handshake
3. Client sends hashed auth response
4. Server replies with AuthSwitchRequest to mysql_clear_password
5. Client sends password in plaintext
6. Attacker captures plaintext password

PoC

Rogue MySQL server (Node.js, ~80 lines) that captures plaintext passwords from mysql2 clients. Tested against mysql2 3.20.0. Full PoC available on request.

Suggested Fix

Remove mysql_clear_password from standardAuthPlugins, or add a guard requiring TLS/unix socket before allowing cleartext auth.

Impact

• mysql2: 9M weekly downloads
• Any application connecting without TLS is vulnerable to credential theft
• Cloud environments with untrusted network paths are especially at risk

Severity

• CVSS Score: 8.2 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/sidorares/node-mysql2/security/advisories/GHSA-3f6p-5ww8-9rcr
• https://github.com/sidorares/node-mysql2/issues/1617
• https://github.com/sidorares/node-mysql2/pull/4236
• https://github.com/sidorares/node-mysql2/commit/884bec56288d827939d0dd3f1f4ae476fbc8dbeb
• https://github.com/sidorares/node-mysql2/releases/tag/v3.22.0
• https://github.com/advisories/GHSA-3f6p-5ww8-9rcr

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

sidorares/node-mysql2 (mysql2)

v3.22.0

Compare Source

Features

• disable mysql_clear_password plugin by default (#​4236) (884bec5), closes #​1617
• implement COM_RESET_CONNECTION with pool integration (#​4148) (49a64cc)

Performance Improvements

• defer Error object creation to error handlers in promise wrappers (#​4257) (ab131de)

v3.21.1

Compare Source

Bug Fixes

• limit client flags to server capabilities (#​4227) (e1930b8)
• use Number.isSafeInteger for supportBigNumbers boundary check (#​4225) (295264b)

v3.21.0

Compare Source

Features

• add support for query attributes (#​4223) (d732f78)
• types: export ExecuteValues and QueryValues from entry point (9fafd6f)

v3.20.0

Compare Source

Features

• add TracingChannel support for native APM instrumentation (#​4178) (c06afc2)

Bug Fixes

• explicitly specify in auth plugins (#​4175) (#​4187) (5ac5563)
• prevent double release from corrupting the connection pool (#​4186) (7e57db6)
• restore PoolConnection as subclass of Connection (#​4183) (97855a6)

v3.19.1

Compare Source

Bug Fixes

• bound null-terminated string read to packet end (fixes a potential OOB read reported by Doruk Tan Ozturk (peaktwilight)) (#​4161) (91c5229)
• handle malformed geometry payloads (fixes a potential DoS vulnerability reported by Doruk Tan Ozturk (peaktwilight)) (#​4164) (1869215)
• prevent query param override of URL-defined connection options (fixes a potential config injection vulnerability reported by Doruk Tan Ozturk (peaktwilight)) (#​4162) (3123b4e)
• validate buffer bounds in geometry parser (fixes a potential DoS vulnerability reported by Doruk Tan Ozturk (peaktwilight)) (#​4159) (7c2ae00)

v3.19.0

Compare Source

Features

• use server's preferred auth method to eliminate auth switch roundtrip (#​4140) (b57c671)

Bug Fixes

• fix precision loss for large decimal values (#​4135) (099beea)

v3.18.2

Compare Source

Bug Fixes

• types: add supportBigNumbers, bigNumberStrings, dateStrings, and timezone options to QueryOptions (#​4127) (b274e72)
• types: extend QueryValues to callback-based methods (#​4129) (2ad5f0b)
• types: improve ExecuteValues "nested" params (#​4133) (3f94950)
• types: support Raw and Uint8Array params (#​4132) (bde9aec)

v3.18.1

Compare Source

Bug Fixes

• types: ensure optional params in query and execute methods (#​4123) (3f4bbca)

v3.18.0

Compare Source

Features

• add Symbol.dispose and Symbol.asyncDispose support for Connections, Pools, and Pool Clusters (#​4112) (1e612dc)

v3.17.5

Compare Source

Bug Fixes

• add missing charset encoding for UTF8MB4_0900_BIN (#​3855) (c9a0dcd)
• deps: include @types/node as a peer dependency (#​4108) (5f8ac97)
• fix wrong length number write to packet (#​3177) (0e06e02)
• pool: resolve potential memory leak (#​4111) (8aa2052)

v3.17.4

Compare Source

Bug Fixes

• types for query values (#​3985) (a9c8d09)

v3.17.3

Compare Source

Bug Fixes

• fix PoolConnection.end callback and promise resolution (#​3937) (18ff2c6)

v3.17.2

Compare Source

Bug Fixes

• distinguish delimiters in queries from SQL comments (#​4084) (454ba10)
• pool: discard connection on error 1290 (Aurora read-only failure) (#​4075) (9188963)
• pool: handle all read-only errors during Aurora failover (#​4082) (ce98d8e)

v3.17.1

Compare Source

Bug Fixes

• expand object params after ON DUPLICATE KEY UPDATE preceded by SET (#​4076) (4d2b930)

v3.17.0

Compare Source

Bug Fixes

• security: resolve a potential SQL injection bypass through objects (#​4054) (7f133cc)

v3.16.3

Compare Source

Bug Fixes

• constants: remove unsupported CLIENT_DEPRECATE_EOF flag from constants (#​4033) (46c3f60)

v3.16.2

Compare Source

Bug Fixes

• types: add missing ConnectionState type to Promise Connection interface (#​4034) (2927949)

v3.16.1

Compare Source

Bug Fixes

• named-placeholders: improve handling of mixed/nested quotes in query parsing (#​4011) (3e00cd7)

v3.16.0

Compare Source

Features

• BaseConnection: add state getter to track connection lifecycle (#​3958) (a394487)

v3.15.3

Compare Source

Bug Fixes

• skip SNI for IP addresses in TLS connection (#​3835) (6000eb2)

v3.15.2

Compare Source

Bug Fixes

• fix sha256_password to work correctly over a TLS connection (#​3809) (fb9eae1)

v3.15.1

Compare Source

Bug Fixes

• typings: missing callback to PoolCluster.end() (#​3819) (53a9bc2)

v3.15.0

Compare Source

Features

• gracefully end pool connections #​3148 (#​3776) (e72247f)

v3.14.5

Compare Source

Bug Fixes

• types: restrict StreamOptions.objectMode to true (#​3686) (#​3784) (c091f1b)

v3.14.4

Compare Source

Bug Fixes

• destroy connection when stream errors (#​3769) (cc34a83)
• fix backpressure when using TLS (#​1752) (64ea4cd)
• stream: resume connection when stream errors or is destroyed (#​3775) (9642a1e)

v3.14.3

Compare Source

Bug Fixes

• resolve parser cache collision with dual typeCast connections (#​3644) (ce2ad75)

v3.14.2

Compare Source

Bug Fixes

• pass columnType to readDateTimeString (#​3700) (1ee48cc)

v3.14.1

Compare Source

Miscellaneous Chores

• release 3.14.1 (9d097f8)

v3.14.0

Compare Source

Features

• add RegExp support to PoolCluster (#​3451) (2d5050d)

v3.13.0

Compare Source

Features

• disableEval: add static parsers (#​3365) (51da653)
• support Cloudflare Workers (#​2289) (a79253d)

Bug Fixes

• PromisePoolCluster.of returns PromisePoolCluster instead of PoolNamespace (#​3261) (be22202)
• query: support VECTOR packets in static parser (#​3379) (603c246)

v3.12.0

Compare Source

Features

• PoolCluster: restoreNodeTimeout implementation (#​3218) (9a38601)

v3.11.5

Compare Source

Bug Fixes

• 1040 datetime fields returned without time part when time is 00:00:00 (#​3204) (bded498)
• circular dependencies (#​3081) (d5a76e6)
• Deno v2 requires commonjs type explicitly (#​3209) (cdc9415)

v3.11.4

Compare Source

Bug Fixes

• types: correct TypeCast's Next callback to return unknown (#​3129) (401db79)

v3.11.3

Compare Source

Bug Fixes

• typings: synchronize types of sqlstring (#​3047) (81be01b)

v3.11.2

Compare Source

Bug Fixes

• resolve LRU conflicts, cache loss and premature engine breaking change (#​2988) (2c3c858)

v3.11.1

Compare Source

Bug Fixes

• createPoolCluster: add pattern and selector to promise-based getConnection (#​3017) (ab7c49f), closes #​1381
• update connection cleanup process to handle expired connections and exceeding config.maxIdle (#​3022) (b091cf4)

v3.11.0

Compare Source

Features

• fully support VECTOR type results (9576742)

v3.10.3

Compare Source

Bug Fixes

• handshake SSL error with AWS RDS (#​2857) (de071bb)

v3.10.2

Compare Source

Bug Fixes

• typeCast: ensure the same behavior for field.string() with query and execute (#​2820) (27e38ea)

v3.10.1

Compare Source

Bug Fixes

• setMaxParserCache throws TypeError (#​2757) (aa8604a)

v3.10.0

Compare Source

Features

• add jsonStrings option (#​2642) (9820fe5)

Bug Fixes

• stream: reads should emit the dataset number for each dataset (#​2628) (4dab4ca)

v3.9.9

Compare Source

Bug Fixes

• connection config: remove keepAliveInitialDelay default value (#​2712) (688ebab)

v3.9.8

Compare Source

Bug Fixes

• security: sanitize fields and tables when using nestTables (#​2702) (efe3db5)
• support deno + caching_sha2_password FULL_AUTHENTICATION_PACKET flow (#​2704) (2e03694)
• typings: typo from jonServerPublicKey to onServerPublicKey (#​2699) (8b5f691)

v3.9.7

Compare Source

Bug Fixes

• security: sanitize timezone parameter value to prevent code injection (#​2608) (7d4b098)

v3.9.6

Compare Source

Bug Fixes

• binary parser sometimes reads out of packet bounds when results contain null and typecast is false (#​2601) (705835d)

v3.9.5

Compare Source

Bug Fixes

• revert breaking change in results creation (#​2591) (f7c60d0)

v3.9.4

Compare Source

Bug Fixes

• docs: improve the contribution guidelines (#​2552) (8a818ce)
• security: improve results object creation (#​2574) (4a964a3)
• security: improve supportBigNumbers and bigNumberStrings sanitization (#​2572) (74abf9e)

v3.9.3

Compare Source

Bug Fixes

• security: improve cache key formation (#​2424) (0d54b0c)
  • Fixes a potential parser cache poisoning attack vulnerability reported by Vsevolod Kokorin (Slonser) of Solidlab
• update Amazon RDS SSL CA cert (#​2131) (d9dccfd)

v3.9.2

Compare Source

Bug Fixes

• stream: premature close when it is paused (#​2416) (7c6bc64)
• types: expose TypeCast types (#​2425) (336a7f1)

v3.9.1

Compare Source

Bug Fixes

• types: support encoding for string type cast (#​2407) (1dc2011)

v3.9.0

Compare Source

Features

• introduce typeCast for execute method (#​2398) (baaa92a)

v3.8.0

Compare Source

Features

• perf: cache iconv decoder (#​2391) (b95b3db)

Bug Fixes

• stream: premature close when using for await (#​2389) (af47148)
• The removeIdleTimeoutConnectionsTimer did not clean up when the … (#​2384) (18a44f6)
• types: add missing types to TypeCast (#​2390) (78ce495)

v3.7.1

Compare Source

Bug Fixes

• add condition which allows code in callback to be reachable (#​2376) (8d5b903)

v3.7.0

Compare Source

Features

• docs: release documentation website (#​2339) (c0d77c0)

v3.6.5

Compare Source

Bug Fixes

• add decodeuricomponent to parse uri encoded special characters in host, username, password and database keys (#​2277) (fe573ad)

v3.6.4

Compare Source

Bug Fixes

• malformed FieldPacket (#​2280) (8831e09)
• move missing options to ConnectionOptions (#​2288) (5cd7639)

v3.6.3

Compare Source

Bug Fixes

• correctly pass values when used with sql-template-strings library (#​2266) (6444f99)

v3.6.2

Compare Source

Bug Fixes

• sql-template-strings/tag compatibility (#​2238) (f2efe5a)

v3.6.1

Compare Source

Bug Fixes

• EventEmitter on method signatures to use spread syntax (#​2200) (5d21b81)

v3.6.0

Compare Source

Features

• add conn-level infileStreamFactory option (#​2159) (5bed0f8)

v3.5.2

Compare Source

Bug Fixes

• Update events that are propagated from pool cluster to include remove (#​2114) (927d209)

v3.5.1

Compare Source

Bug Fixes

• improvements to allow to use Bun and tls (#​2119) (fd44a2a)
• missing ResultSetHeader[] to query and execute (f649486)

v3.5.0

Compare Source

Features

• improved inspection of columns (#​2112) (69277aa)

v3.4.5

Compare Source

Bug Fixes

• handle prepare response with actual number of parameter definition less than reported in the prepare header. Fixes #​2052 (b658be0)

v3.4.4

Compare Source

Bug Fixes

• add ProcedureCallPacket to execute overloads (3566ef7)
• add ProcedureCallPacket to query overloads (352c3bc)
• add ProcedureCallPacket to promise-based execute overloads (8292416)
• add ProcedureCallPacket to promise-based query overloads (0f31a41)
• create ProcedureCallPacket typings (09ad1d2)

v3.4.3

Compare Source

Bug Fixes

• remove acquireTimeout invalid option (#​2095) (eb311db)

v3.4.2

Compare Source

Bug Fixes

• changing type files to declaration type files (98e6f3a)

v3.4.1

Compare Source

Bug Fixes

• createPool uri overload (98623dd)
• PoolCluster typings (3902ca6)
• create promise-based PoolCluster typings (7f38496)
• missing parserCache in promise.js (7f35cf5)
• missing constants in promise.js (4ce2c70)
• missing keys for Types constant (86655ec)
• missing typings for Charsets constants (01f77a0)
• missing typings for CharsetToEncoding constants (609229a)
• missing typings for parserCache (891a523)
• missing typings for Types constant (04601dd)
• rename file of typings Charsets constants (51c4196)

v3.4.0

Compare Source

Features

• support STATE_GTIDS session track information (2b1520f)

v3.3.5

Compare Source

Bug Fixes

• createPool

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.