ZeroDay Findings
Sign inSign up

Findings

CVE-2026-107382

MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLS

Published Oct 8, 2026 · corrected/updated Oct 16, 2026 · evidence confidence high

### Description On the zero-configuration TLS path, the connector accepts a self-signed server certificate at the TLS level and then validates the server's identity from the fingerprint hash the server appends to the final OK_Packet ( ). That validation calls on the authentication plugin in use to obtain the password-derived secret both sides combine with the seed and the certificate fingerprint. referenced an identifier that was not in scope: it was neither a parameter of the method nor a module-scope binding, existing only as a parameter of the unrelated static . Invoking the method therefore threw . The throw happens synchronously inside the socket handler, and no frame between and the plugin guards it, so the error escapes as an uncaught exception rather than surfacing as a connection error. Because the fingerprint hash is what a legitimate MariaDB server sends on this path, ed25519 authentication with zero-configuration TLS never completed successfully — the failure is not limited to a hostile server. ### Impact Denial of service against the client process. Under Node's default behaviour the process exits, so a long-running service is terminated rather than seeing a failed connection attempt. No credential is disclosed and no data is altered; the impact is availability only. An unauthenticated attacker able to intercept the connection (a MitM presenting a self-signed certificate, or a compromised server) can trigger the crash at will, since the self-signed-certificate path is precisely what such an attacker exercises and the rogue server only has to answer the ed25519 challenge with an OK_Packet carrying a -prefixed validation hash. Exposure requires all of the following: a MariaDB server reached over TCP (not a unix socket), or an object without , a password set, no provided, and as the negotiated authentication plugin. Other authentication plugins are unaffected, as is any configuration where the server certificate is verified against a provided CA. ### Resol

Grounded briefings

Catalog interpretations for three audiences. Each brief cites ingested metadata and the original advisories below. They are not independent research and they do not invent exploit steps.

Executive

CVE-2026-107382 is a medium public vulnerability record for this product. It is not currently listed in the CISA Known Exploited catalog. Check the linked vendor or CERT advisories for patch status. This summary is a catalog interpretation of the ingested metadata and cites the original advisories below.

System administrator

Identify whether this product is in your estate, then compare installed versions with the affected ranges. Affected packages or ranges on record: mariadb (3.3.0 → 3.5.4); mariadb-min (3.3.0 → 3.5.4); mysql-client (3.3.0 → 3.5.4); mariadb (3.3.0 → 3.5.4). Check the linked vendor or CERT advisories for patch status. Prefer the vendor or distribution advisory linked in Sources before changing production systems. This is a catalog interpretation, not a runbook.

Security analyst

Signals on file: CVSS 5.9, EPSS 0.2%. It is not currently listed in the CISA Known Exploited catalog. Weakness classes: CWE-248. Sources contributing to this record: cve_org, epss, github, osv. Public exploit references, when present, are outbound links only and are not proof of active exploitation. This is a catalog interpretation of stored metadata.

Exploitation and remediation

  • Exploitation evidence

    Not listed as known exploited in CISA KEV. Not in the CISA KEV catalog.

  • Patch and remediation

    No required-action text is stored yet. Use the vendor or CERT links in Sources for patch availability.

  • Safe detection guidance

    Compare installed versions with the affected ranges below and verify the advisory from the original publisher. This site stores metadata and outbound links only; it does not ship exploit code or proof-of-concept payloads.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 8, 2026 · GitHub Advisory Database

    Detected

    ### Description On the zero-configuration TLS path, the connector accepts a self-signed server certificate at the TLS level and then validates the server's identity from the fingerprint hash the server appends to the final OK_Packet ( ). That validation calls on the authentication plugin in use to obtain the password-derived secret both sides combine with the seed and the certificate fingerprint.

  2. Oct 16, 2026 · GitHub Advisory Database

    Fix available

    mariadb fixed in 3.5.4

  3. Oct 16, 2026 · GitHub Advisory Database

    Fix available

    mariadb fixed in 3.5.4

  4. Oct 16, 2026 · GitHub Advisory Database

    Fix available

    mariadb-min fixed in 3.5.4

  5. Oct 16, 2026 · GitHub Advisory Database

    Fix available

    mariadb-min fixed in 3.5.4

  6. Oct 16, 2026 · GitHub Advisory Database

    Fix available

    mysql-client fixed in 3.5.4

  7. Oct 16, 2026 · GitHub Advisory Database

    Fix available

    mysql-client fixed in 3.5.4

  8. Oct 16, 2026 · GitHub Advisory Database

    Updated

    ### Description On the zero-configuration TLS path, the connector accepts a self-signed server certificate at the TLS level and then validates the server's identity from the fingerprint hash the server appends to the final OK_Packet ( ). That validation calls on the authentication plugin in use to obtain the password-derived secret both sides combine with the seed and the certificate fingerprint.

Affected

  • Bitnami mariadb3.3.0 → 3.5.4
  • Bitnami mariadb-min3.3.0 → 3.5.4
  • Bitnami mysql-client3.3.0 → 3.5.4
  • npm mariadb3.3.0 → 3.5.4

Sources

  • CVE.orgVulnerability recordCVE-2026-107382

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-107382

    30-day exploitation probability 0.2%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-cx2f-j9fh-8g68

    GitHub Advisory Database record mirrored by OSV.

    github.com
  • OSV.devPackage advisoryBIT-mariadb-2026-107382

    MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLS

    osv.dev
  • OSV.devPackage advisoryBIT-mariadb-min-2026-107382

    MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLS

    osv.dev
  • OSV.devPackage advisoryBIT-mysql-client-2026-107382

    MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLS

    osv.dev
  • OSV.devPackage advisoryGHSA-cx2f-j9fh-8g68

    MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLS

    osv.dev

References