MariaDB Node.js Connector Patched for High-Severity SQL Injection Flaw

MariaDB Corporation has released patches for a high-severity SQL injection vulnerability in its Node.js connector, affecting applications that use the library to interact with MariaDB and MySQL databases. The issue, tracked as CVE-2026-107384, allows attackers to execute arbitrary SQL commands if a specific non-default configuration option is enabled.

The vulnerability stems from how the connector handles object keys when the `permitSetMultiParamEntries` option is turned on. According to the National Vulnerability Database, this feature expands object keys into SQL SET clauses. However, in affected versions, the code failed to pass these keys through the `escapeId` function, which is designed to safely handle identifiers.

Instead, the keys were written directly into the SQL statement. An attacker who controls the object keys can insert a backtick character to close the quoted identifier, causing the remainder of the key to be interpreted as executable SQL. This can allow an attacker to update unintended columns or append arbitrary SQL with the privileges of the database user.

Context and Background

The flaw is rated as High severity with a CVSS score of 8.1. It is classified under CWE-89, which covers SQL injection weaknesses. The issue was reported by researcher fg0x0. According to GitHub advisory GHSA-v6pj-gxxw-phfw, this vulnerability represents an incomplete fix for a previous issue, GitHub issue #252. That earlier fix in 2023 corrected the `escapeId` function itself but left three specific code paths unchanged. Those paths continued to build backtick-quoted identifiers by hand without using the escaper, leaving the application exposed to injection attacks via object keys.

The `permitSetMultiParamEntries` option is disabled by default. When disabled, the connector serializes objects and escapes them as single string literals, meaning the keys never reach the SQL grammar and the vulnerability is not triggered. The advisory notes that enabling this option is typically done when developers want to pass request bodies directly into query parameters, allowing keys to become column names. However, this convenience feature inadvertently allowed keys to become arbitrary SQL when not properly escaped.

Who Is Affected

The vulnerability affects users of the `mariadb` npm package. Specifically, the following version ranges are vulnerable:

• Versions 3.2.0 up to, but not including, 3.2.5
• Versions 3.3.0 up to, but not including, 3.3.4
• Versions 3.4.0 up to, but not including, 3.4.7
• Versions 3.5.0-rc.0 up to, but not including, 3.5.4

Patches have been released for all these branches. Users should update to version 3.2.5, 3.3.4, 3.4.7, or 3.5.4, depending on their current major version. The fix ensures that all three expansion sites now route keys through the identifier escaper, which correctly doubles backticks before writing the column name. This resolves the injection vector while preserving the feature's functionality for legitimate keys, including reserved words.

What should you do?

Security professionals should immediately check their Node.js applications for usage of the `mariadb` package. If the package is present, verify the installed version against the vulnerable ranges listed above. If an application relies on the `permitSetMultiParamEntries` option, prioritize upgrading to the patched version. Until an upgrade is possible, consider disabling the option if the application logic permits, or implement strict allow-list validation for object keys before they are passed to query functions.