MediumGHSA-49j4-86m8-q2jwCVE-2024-21509
mysql2 vulnerable to Prototype Poisoning
Published 10 Apr 2024 · Updated 10 Sept 2026
Affected package
mysql2npm
- Affected
- <3.9.4
- Fixed in
- 3.9.4
Update to the fixed version for your release line, for example:
npm install mysql2@3.9.4Details
Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through parserFn in text_parser.js and binary_parser.js.
Is GHSA-49j4-86m8-q2jw in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected mysql2, and gives you the command that fixes it.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2024-21509
- Linkgithub.com/sidorares/node-mysql2/pull/2574
- Linkgithub.com/sidorares/node-mysql2/commit/4a964a3910a4b8de008696c554ab1b492e9b4691
- Linkblog.slonser.info/posts/mysql2-attacker-configuration
- Packagegithub.com/sidorares/node-mysql2
- Linkgithub.com/sidorares/node-mysql2/blob/fd3d117da82cc5c5fa5a3701d7b33ca77691bc61/lib/parsers/text_parser.js%23L134
- Linkgithub.com/sidorares/node-mysql2/releases/tag/v3.9.4
- Linksecurity.snyk.io/vuln/SNYK-JS-MYSQL2-6591084
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.