MariaDB Connector/Node.js CVE-2026-107382

Exploitable only against mariadb-connector-nodejs 3.3.0 through 3.5.3 when ALL of the following hold simultaneously: the client connects to a MariaDB/MySQL server over TCP (not a Unix socket); TLS is enabled via ssl: true or an ssl object whose rejectUnauthorized is not false; a password is configured; no ssl.ca is provided (so the zero-configuration TLS fingerprint-validation path is used); and client_ed25519 is negotiated as the authentication plugin. Under these conditions, any server or network attacker presenting a self-signed certificate reaches the vulnerable code. Exploitation is LIMITED/prevented by: supplying an explicit ssl.ca, setting rejectUnauthorized: false, using any authentication plugin other than client_ed25519, or connecting over a Unix socket - each of these avoids the vulnerable path entirely.

This is a genuine but moderate-priority issue rather than a high-impact emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, base 5.9 Medium) is internally consistent with the description: network-reachable and unauthenticated, but high complexity because exploitation requires a specific TLS zero-configuration deployment (ssl enabled without a CA, password set, client_ed25519 negotiated) plus the attacker presenting a self-signed certificate. Impact is availability-only (A:H) - a client-side process crash via an uncaught ReferenceError (CWE-248); there is no confidentiality or integrity impact and no code execution. No EPSS score was provided and the vulnerability is not listed in CISA KEV, so there is no evidence of active or widespread exploitation. No explicit POC flag was supplied; the only reproduction artifact is the vendor's own regression test in the fix commit, which demonstrates the bug is trivially triggerable once the preconditions hold but is not weaponized exploit code. Note the crash can also be triggered by a legitimate but misconfigured server presenting a self-signed cert, so some real-world occurrences will be accidental rather than adversarial. Overall: a real client-side DoS worth patching in affected deployments, but the narrow configuration preconditions and availability-only impact keep real risk well below the headline 'network/unauthenticated' framing.

A Node.js application uses mariadb-connector-nodejs (3.3.0-3.5.3) with zero-configuration TLS (ssl: true or an ssl object without rejectUnauthorized:false), a password, no ssl.ca, and ed25519 authentication. A network man-in-the-middle attacker - or a malicious/misconfigured server - presents a self-signed certificate, forcing the client onto the fingerprint-validation path that calls Ed25519PasswordAuth.hash(), which references an out-of-scope seed identifier and throws a synchronous ReferenceError. The exception escapes the socket data handler, and under Node.js default uncaught-exception behavior the client process terminates, causing denial of service. No public weaponized exploit is identified, but the vendor's regression test shows the condition is trivially reproducible.