Advisory Database
  • Advisories
  • Dependency Scanning
  1. npm
  2. ›
  3. mysql2
  4. ›
  5. GHSA-3f6p-5ww8-9rcr

GHSA-3f6p-5ww8-9rcr: MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials

September 1, 2026

A rogue MySQL server (or MITM) can force mysql2 to send credentials in plaintext by requesting an auth switch to mysql_clear_password. The driver complies without verifying that TLS is active.

References

  • github.com/advisories/GHSA-3f6p-5ww8-9rcr
  • github.com/sidorares/node-mysql2/commit/884bec56288d827939d0dd3f1f4ae476fbc8dbeb
  • github.com/sidorares/node-mysql2/issues/1617
  • github.com/sidorares/node-mysql2/pull/4236
  • github.com/sidorares/node-mysql2/releases/tag/v3.22.0
  • github.com/sidorares/node-mysql2/security/advisories/GHSA-3f6p-5ww8-9rcr

Code Behaviors & Features

Detect and mitigate GHSA-3f6p-5ww8-9rcr with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 3.22.0

Fixed versions

  • 3.22.0

Solution

Upgrade to version 3.22.0 or above.

Impact 7.5 HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Learn more about CVSS

Weakness

  • CWE-522: Insufficiently Protected Credentials

Source file

npm/mysql2/GHSA-3f6p-5ww8-9rcr.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 09 Sep 2026 12:21:41 +0000.