GHSA-rgwj-5xj2-c3m3: MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS

August 31, 2026 (updated September 2, 2026)

Denial of Service of the client application (process crash / OOM) — not the database itself. No authentication bypass or data exposure. Requires compress: true plus a malicious/compromised server or MITM position.

References

github.com/advisories/GHSA-rgwj-5xj2-c3m3
github.com/sidorares/node-mysql2/commit/7c48343c95ecc80d30d6ebfa67875947b7d848d2
github.com/sidorares/node-mysql2/releases/tag/v3.23.1
github.com/sidorares/node-mysql2/security/advisories/GHSA-rgwj-5xj2-c3m3

Code Behaviors & Features

Detect and mitigate GHSA-rgwj-5xj2-c3m3 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →