CVE-2024-21509

mysql2 vulnerable to Prototype Poisoning

6.5 MediumFix available

Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through parserFn in text_parser.js and binary_parser.js.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: Low

Exploit likelihood

0.95%Up 0.9 points since Apr 10, 2024

What each source reports

CVE List Score used 6.5

Record: CVE-2024-21509
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P
Weakness: CWE-1321, CWE-1321
Updated: 2026-11-02

EUVDEUVD-2024-1089 6.5

Record: EUVD-2024-1089
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P
Updated: 2026-11-03

GitHub AdvisoriesGHSA-49j4-86m8-q2jw 6.9

mysql2 vulnerable to Prototype Poisoning

Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through parserFn in text_parser.js and binary_parser.js.

Record: GHSA-49j4-86m8-q2jw
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness: CWE-1321
Updated: 2026-11-02

NVD 6.5

Record: CVE-2024-21509
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness: CWE-1321
Updated: 2026-11-02

OSV 6.5

Record: CVE-2024-21509
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P
Weakness: CWE-1321
Updated: 2026-11-02

OSVGHSA-49j4-86m8-q2jw 6.9

mysql2 vulnerable to Prototype Poisoning

Record: GHSA-49j4-86m8-q2jw
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness: CWE-1321
Updated: 2026-11-02

OSVCLSA-2026-1786373168 No score

TuxCare security update for mysql2 (1 CVE)

TuxCare rebuilt mysql2 to address 1 CVE. Fixed in 2.3.3-tuxcare.5.

Record: CLSA-2026-1786373168
Updated: 2026-11-02

OSVROOT-APP-NPM-CVE-2024-21509 No score

CVE-2024-21509 in @rootio/mysql2 - Patched by Root

Root has patched CVE-2024-21509 in the @rootio/mysql2 package for Root:npm. Multiple fixed versions available.

Record: ROOT-APP-NPM-CVE-2024-21509
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`mysql2` npm	before 3.9.4	3.9.4
`mysql2` TuxCare:npm	2.3.3-tuxcare.0 up to 2.3.3-tuxcare.5, plus listed versions 2.3.32.3.3-tuxcare.12.3.3-tuxcare.22.3.3-tuxcare.32.3.3-tuxcare.4	2.3.3-tuxcare.5
`@rootio/mysql2` Root:npm	before 3.9.2-root.io.2	3.9.2-root.io.2
`mysql2` Root:npm	before 3.9.2-aikido.2	3.9.2-aikido.2

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-21509 is a medium vulnerability (CVSS 6.5) in Mysqljs Mysql2, published April 10, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.95%, the 61st percentile. Fixed in mysql2 3.9.4.

References

Show 4 moreShow less