CVE-2024-21507
mysql2 cache poisoning vulnerability
Versions of the package mysql2 before 3.9.3 are vulnerable to Improper Input Validation through the keyFromFields function, resulting in cache poisoning. An attacker can inject a colon (:) character within a value of the attacker-crafted key.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Versions of the package mysql2 before 3.9.3 are vulnerable to Improper Input Validation through the keyFromFields function, resulting in cache poisoning. An attacker can inject a colon (:) character within a value of the attacker-crafted key.
- Record
CVE-2024-21507- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L/E:P - Weakness
- CWE-20, CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2024-1251
Versions of the package mysql2 before 3.9.3 are vulnerable to Improper Input Validation through the keyFromFields function, resulting in cache poisoning. An attacker can inject a colon (:) character within a value of the attacker-crafted key.
- Record
EUVD-2024-1251- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L/E:P - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mqr2-w7wj-jjgr
mysql2 cache poisoning vulnerability
Versions of the package mysql2 before 3.9.3 are vulnerable to Improper Input Validation through the keyFromFields function, resulting in cache poisoning. An attacker can inject a colon : character within a value of the attacker-crafted key.
- Record
GHSA-mqr2-w7wj-jjgr- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L - Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
Versions of the package mysql2 before 3.9.3 are vulnerable to Improper Input Validation through the keyFromFields function, resulting in cache poisoning. An attacker can inject a colon (:) character within a value of the attacker-crafted key.
- Record
CVE-2024-21507- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
Versions of the package mysql2 before 3.9.3 are vulnerable to Improper Input Validation through the keyFromFields function, resulting in cache poisoning. An attacker can inject a colon (:) character within a value of the attacker-crafted key.
- Record
CVE-2024-21507- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L/E:P - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-mqr2-w7wj-jjgr
mysql2 cache poisoning vulnerability
Versions of the package mysql2 before 3.9.3 are vulnerable to Improper Input Validation through the keyFromFields function, resulting in cache poisoning. An attacker can inject a colon : character within a value of the attacker-crafted key.
- Record
GHSA-mqr2-w7wj-jjgr- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVCLSA-2026-1777336745 No score
TuxCare security update for mysql2 (1 CVE)
TuxCare rebuilt mysql2 to address 1 CVE. Fixed in 2.3.3-tuxcare.4.
- Record
CLSA-2026-1777336745- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2024-21507 No score
CVE-2024-21507 in @rootio/mysql2 - Patched by Root
Root has patched CVE-2024-21507 in the @rootio/mysql2 package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2024-21507- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mysql2npm |
before 3.9.3 | 3.9.3 |
mysql2TuxCare:npm |
2.3.3-tuxcare.0 up to 2.3.3-tuxcare.4, plus listed versions 2.3.32.3.3-tuxcare.12.3.3-tuxcare.22.3.3-tuxcare.3 |
2.3.3-tuxcare.4 |
@rootio/mysql2Root:npm |
before 3.9.2-root.io.2 | 3.9.2-root.io.2 |
mysql2Root:npm |
before 3.9.2-aikido.2 | 3.9.2-aikido.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-21507 is a medium vulnerability (CVSS 6.5) in Mysqljs Mysql2, published April 10, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.74%, the 55th percentile. Fixed in mysql2 3.9.3.
References
security.snyk.io/vuln/SNYK-JS-MYSQL2-6591300
github.com/sidorares/node-mysql2/commit/0d54b0ca6498c823098426038162ef10df02c818
blog.slonser.info/posts/mysql2-attacker-configuration
nvd.nist.gov/vuln/detail/CVE-2024-21507