CVE-2026-55855

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js permits SQL injection when attacker-controlled Buffer parameters are escaped client-side under the big5, gbk, sjis, cp932, or gb18030 client character sets. PacketOutputStream.writeBufferEscape in lib/io/packet-output-stream.js escaped bytes without the charset-aware getMbRecognizer logic in lib/misc/charset-mb.js. The server SQL lexer runs my_ismbchar before escape processing, so an attacker-controlled lead byte can consume the inserted 0x5C backslash as a multibyte trail byte and leave the following 0x27 quote unescaped, terminating the string literal and allowing arbitrary SQL. The default utf8mb4 character set and parameters sent through the execute binary prepared-statement path are not affected. Successful exploitation can expose or modify data available to the database account. This issue is fixed in versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3.

• CWE-89
• CWE-116

• https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/25c6239b68fd909132355c3f8535a5ef32423468
• https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/26e35f9edb00bcf249627a564e0052fba7b305a2
• https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/7af8b7b8b7ae5e1a081693ade989f5a80c8e06e3
• https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/97f183f33b5d4e6767b34ecabdd81fe3294a80a6
• https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.2.4
• https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.3.3
• https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.4.6
• https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.5.3
• https://github.com/mariadb-corporation/mariadb-connector-nodejs/security/advisories/GHSA-g5xc-5w98-jfvm
• https://jira.mariadb.org/browse/CONJS-350

Published

Aug 28, 2026

Last Modified

Sep 8, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55849@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of …8.5
• CVE-2026-5585A vulnerability was found in Tencent AI-Infra-Guard 4.0. The…7.5
• CVE-2026-55850Element Web is a Matrix web client built using the Matrix Re…5.3
• CVE-2026-55851Netty is a network application framework for development of …7.5
• CVE-2026-55852Frappe is a full-stack web application framework. Prior to 1…8.6
• CVE-2026-55854MariaDB Connector/Node.js is used to connect applications de…5.9
• CVE-2026-55856MariaDB Connector/J is used to connect applications develope…5.9
• CVE-2026-55857MariaDB Connector/J is used to connect applications develope…5.9
• CVE-2026-55858MariaDB Connector/J is used to connect applications develope…5.9
• CVE-2026-55859MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL …5.9
• CVE-2026-5586A vulnerability was determined in zhongyu09 openchatbi up to…6.3
• CVE-2026-55860MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL …5.9