MariaDB Connector/Node.js CVE-2026-55855

Exploitation requires all three conditions to hold simultaneously: (1) the mariadb npm package version is below the patched threshold for the installed 3.x branch (below 3.2.4, 3.3.3, 3.4.6, or 3.5.3); (2) the database connection's character_set_client is explicitly set to one of big5, gbk, sjis, cp932, or gb18030 - these are non-default configurations that must be deliberately chosen by the application developer, typically for East Asian locale support; and (3) attacker-controlled data reaches a Buffer-typed query parameter on the client-side text escape path (i.e., via the query() API with parameter interpolation, not the execute() binary prepared-statement API). Deployments using the default utf8mb4 charset are fully immune to this vector. Use of the execute() binary prepared-statement path also prevents exploitation regardless of charset. The CVSS PR:N rating reflects that the attacker does not need database or application credentials - only the ability to supply input that the application passes as a Buffer query parameter.

The CVSS 6.5 score with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N reflects the network-reachable nature of the injection while correctly marking AC:H due to the non-default character set prerequisite, which materially narrows the exploitable population. Real-world risk is concentrated in applications explicitly configured for East Asian locales - Chinese (GBK, Big5, GB18030), Japanese (Shift-JIS, CP932) - where these character sets are operationally common and the deployment footprint of the vulnerable configuration is non-trivial. The High confidentiality impact (C:H) is consistent with SQL injection enabling arbitrary SELECT queries against the database account's accessible data. Low integrity impact (I:L) reflects limited data modification rather than full schema control. There is no CISA KEV listing and no identified public POC, placing exploitation status at theoretical-but-credible given the well-known nature of the underlying technique. EPSS data was not provided in the input; risk should be assessed primarily on deployment conditions rather than probabilistic scores. The AC:H designation should not lead defenders to deprioritize this if their application uses any of the five affected charsets - those deployments face a practically exploitable SQL injection with only the application accepting attacker-influenced binary data as an additional prerequisite.

An attacker submits a crafted binary payload - for example, through a file upload endpoint or a binary data field - to an application that passes the input as a Buffer parameter in a mariadb connector query operating under the GBK or Big5 character set. The payload's first byte is a valid GBK lead byte (e.g., 0x81); the connector inserts 0x5C before the following 0x27 quote byte to escape it, but the server's SQL lexer treats 0x81 + 0x5C as a single two-byte GBK character and consumes the backslash as its trail byte, leaving the 0x27 unescaped. The bare quote terminates the string literal, and the attacker's remaining bytes are parsed as SQL - for example, injecting a UNION SELECT to return sensitive rows or issuing an UPDATE to modify application data. No public POC has been identified at time of analysis, but the underlying GBK/Big5 escape bypass technique is publicly documented in security literature.