{"id":"GHSA-3f6p-5ww8-9rcr","aliases":["CLSA-2026-1788255454","CLSA-2026-1790622749","CLSA-2026-1792163478","CLSA-2026-1792472736","CLSA-2026-1792486376","CLSA-2026-1792489443","CLSA-2026-1792495278","CLSA-2026-1792506023","GHSA-rgwj-5xj2-c3m3","ROOT-APP-NPM-GHSA-3f6p-5ww8-9rcr"],"status":"published","title":"MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials","description":"## Summary\n\nA rogue MySQL server (or MITM) can force mysql2 to send credentials in **plaintext** by requesting an auth switch to `mysql_clear_password`. The driver complies without verifying that TLS is active.\n\n## Details\n\n`mysql_clear_password` is registered as a default standard plugin in `lib/commands/auth_switch.js` (line 21). When a server sends an AuthSwitchRequest (0xFE) requesting `mysql_clear_password`, the driver executes it without checking for TLS. The plugin (`lib/auth_plugins/mysql_clear_password.js`) returns `Buffer.from(password + '\\0')`.\n\nNote: `caching_sha2_password` plugin DOES check for SSL before sending cleartext (line 77). But `mysql_clear_password` has no such guard.\n\n## Attack Scenario\n\n1. Attacker operates rogue MySQL server or performs MITM\n2. Server advertises `caching_sha2_password` in handshake\n3. Client sends hashed auth response\n4. Server replies with AuthSwitchRequest to `mysql_clear_password`\n5. Client sends password in plaintext\n6. Attacker captures plaintext password\n\n## PoC\n\nRogue MySQL server (Node.js, ~80 lines) that captures plaintext passwords from mysql2 clients. Tested against mysql2 3.20.0. Full PoC available on request.\n\n## Suggested Fix\n\nRemove `mysql_clear_password` from `standardAuthPlugins`, or add a guard requiring TLS/unix socket before allowing cleartext auth.\n\n## Impact\n\n- mysql2: 9M weekly downloads\n- Any application connecting without TLS is vulnerable to credential theft\n- Cloud environments with untrusted network paths are especially at risk","severity":{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-409","CWE-522"],"published":"2026-08-31T22:36:20Z","modified":"2026-10-20T19:30:13Z","fixes":[{"ecosystem":"npm","package":"mysql2","fixed_in":["3.22.0","3.23.1"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"mysql2","fixed_in":["2.3.3-tuxcare.6","3.20.0-tuxcare.1","3.22.6-tuxcare.1","3.22.4-tuxcare.1","3.22.3-tuxcare.1","3.15.3-tuxcare.1","3.22.2-tuxcare.1","3.22.1-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"mysql2","fixed_in":["3.9.8-aikido.1","3.7.1-aikido.4","3.17.0-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/mysql2","fixed_in":["3.9.8-root.io.1","3.7.1-root.io.4","3.17.0-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.23.0"},{"fixed":"3.23.1"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.3-tuxcare.0"},{"fixed":"2.3.3-tuxcare.6"}]}],"versions":["2.3.3","2.3.3-tuxcare.1","2.3.3-tuxcare.2","2.3.3-tuxcare.3","2.3.3-tuxcare.4","2.3.3-tuxcare.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.20.0-tuxcare.0"},{"fixed":"3.20.0-tuxcare.1"}]}],"versions":["3.20.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.22.6-tuxcare.0"},{"fixed":"3.22.6-tuxcare.1"}]}],"versions":["3.22.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.22.4-tuxcare.0"},{"fixed":"3.22.4-tuxcare.1"}]}],"versions":["3.22.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.22.3-tuxcare.0"},{"fixed":"3.22.3-tuxcare.1"}]}],"versions":["3.22.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.15.3-tuxcare.0"},{"fixed":"3.15.3-tuxcare.1"}]}],"versions":["3.15.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.22.2-tuxcare.0"},{"fixed":"3.22.2-tuxcare.1"}]}],"versions":["3.22.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.22.1-tuxcare.0"},{"fixed":"3.22.1-tuxcare.1"}]}],"versions":["3.22.1"]},{"source":"osv","ecosystem":"npm","package":"mysql2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.22.0"}]}]},{"source":"osv","ecosystem":"npm","package":"mysql2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.23.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.8-aikido.1"},{"fixed":"3.7.1-aikido.4"},{"fixed":"3.17.0-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.8-root.io.1"},{"fixed":"3.7.1-root.io.4"},{"fixed":"3.17.0-root.io.1"}]}]}],"references":[{"url":"https://github.com/sidorares/node-mysql2/security/advisories/GHSA-3f6p-5ww8-9rcr","tags":["web"]},{"url":"https://github.com/sidorares/node-mysql2/issues/1617","tags":["web"]},{"url":"https://github.com/sidorares/node-mysql2/pull/4236","tags":["web"]},{"url":"https://github.com/sidorares/node-mysql2/commit/884bec56288d827939d0dd3f1f4ae476fbc8dbeb","tags":["web"]},{"url":"https://github.com/sidorares/node-mysql2/releases/tag/v3.22.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3f6p-5ww8-9rcr"},{"url":"https://github.com/sidorares/node-mysql2/security/advisories/GHSA-rgwj-5xj2-c3m3","tags":["web"]},{"url":"https://github.com/sidorares/node-mysql2/commit/7c48343c95ecc80d30d6ebfa67875947b7d848d2","tags":["web"]},{"url":"https://github.com/sidorares/node-mysql2/releases/tag/v3.23.1","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rgwj-5xj2-c3m3"},{"url":"https://github.com/sidorares/node-mysql2","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-3f6p-5ww8-9rcr","title":"MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials","description":"## Summary\n\nA rogue MySQL server (or MITM) can force mysql2 to send credentials in **plaintext** by requesting an auth switch to `mysql_clear_password`. The driver complies without verifying that TLS is active.\n\n## Details\n\n`mysql_clear_password` is registered as a default standard plugin in `lib/commands/auth_switch.js` (line 21). When a server sends an AuthSwitchRequest (0xFE) requesting `mysql_clear_password`, the driver executes it without checking for TLS. The plugin (`lib/auth_plugins/mysql_clear_password.js`) returns `Buffer.from(password + '\\0')`.\n\nNote: `caching_sha2_password` plugin DOES check for SSL before sending cleartext (line 77). But `mysql_clear_password` has no such guard.\n\n## Attack Scenario\n\n1. Attacker operates rogue MySQL server or performs MITM\n2. Server advertises `caching_sha2_password` in handshake\n3. Client sends hashed auth response\n4. Server replies with AuthSwitchRequest to `mysql_clear_password`\n5. Client sends password in plaintext\n6. Attacker captures plaintext password\n\n## PoC\n\nRogue MySQL server (Node.js, ~80 lines) that captures plaintext passwords from mysql2 clients. Tested against mysql2 3.20.0. Full PoC available on request.\n\n## Suggested Fix\n\nRemove `mysql_clear_password` from `standardAuthPlugins`, or add a guard requiring TLS/unix socket before allowing cleartext auth.\n\n## Impact\n\n- mysql2: 9M weekly downloads\n- Any application connecting without TLS is vulnerable to credential theft\n- Cloud environments with untrusted network paths are especially at risk","status":"published","published":"2026-09-01T16:40:34Z","modified":"2026-09-01T16:40:35Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T14:41:08.980668Z"},{"id":"GHSA-rgwj-5xj2-c3m3","title":"MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS","description":"## Vulnerability Details\n\n**File**: `lib/compressed_protocol.js`\n**Line**: 43 (`zlib.inflate(body, (err, data) =\u003e { ... })` inside `handleCompressedPacket`)\n\n### Root Cause\nWhen a connection is created with `compress: true` (and the server advertises `CLIENT_COMPRESS`), every incoming packet is unwrapped by `handleCompressedPacket()` in `lib/compressed_protocol.js`, which calls:\n\n```js\nzlib.inflate(body, (err, data) =\u003e { ... });\n```\n\nNo options object (in particular, no `maxOutputLength`) is passed. Node's zlib convenience methods default `maxOutputLength` to `buffer.kMaxLength`, which on this platform is `Number.MAX_SAFE_INTEGER` — i.e. effectively unbounded until the process runs out of memory. The 3-byte \"length of payload before compression\" field in the compressed-packet header is read (`packet.readInt24()`) but is only used to branch on `!== 0`; it is never used to cap or validate the actual inflate output size, and the real decompressed size is determined purely by the attacker-supplied deflate stream.\n\nBecause DEFLATE can reach compression ratios over 1000:1 for crafted repetitive input, an attacker who controls (or MITMs, on a non-TLS connection) the MySQL server endpoint can send a single small compressed packet that expands to gigabytes in the client's memory — a classic decompression-bomb / \"zip bomb\" applied to MySQL's client-compression protocol.\n\n### Attack Scenario\n1. Application connects with `mysql2`/`mysql2/promise` using `compress: true` (a documented option for reducing bandwidth, commonly used for cloud/WAN DB connections).\n2. The connection target is attacker-controlled or attacker-compromised, or an attacker MITMs a non-TLS connection.\n3. Right after authentication succeeds, the malicious endpoint sends one crafted compressed packet whose deflate stream is small on the wire (hundreds of KB) but decompresses to several GB.\n4. `zlib.inflate()` starts allocating memory for the full decompressed output with no ceiling.\n5. The Node.js process's RSS grows uncontrolled until OOM-kill or crash — no query needs to be issued by the client; the malicious packet alone is enough.\n\n### Impact\nDenial of Service of the client application (process crash / OOM) — not the database itself. No authentication bypass or data exposure. Requires `compress: true` plus a malicious/compromised server or MITM position.\n\n### Vulnerable Code\n```js\nfunction handleCompressedPacket(packet) {\n  const connection = this;\n  const deflatedLength = packet.readInt24();\n  const body = packet.readBuffer();\n\n  if (deflatedLength !== 0) {\n    connection.inflateQueue.push((task) =\u003e {\n      zlib.inflate(body, (err, data) =\u003e {\n        if (err) {\n          connection._handleNetworkError(err);\n          return;\n        }\n        connection._bumpCompressedSequenceId(packet.numPackets);\n        connection._inflatedPacketsParser.execute(data);\n        task.done();\n      });\n    });\n  } else {\n    ...\n  }\n}\n```\n\n### Recommended Fix\n```js\nconst MAX_INFLATED_PACKET_SIZE = 1 * 1024 * 1024 * 1024; // e.g. 1 GiB, ideally configurable\n\nzlib.inflate(body, { maxOutputLength: MAX_INFLATED_PACKET_SIZE }, (err, data) =\u003e {\n  if (err) {\n    connection._handleNetworkError(err);\n    return;\n  }\n  ...\n});\n```\n`maxOutputLength` makes `zlib.inflate` abort with `ERR_BUFFER_TOO_LARGE` as soon as the decompressed size would exceed the cap, routing into the exact same (already-existing) `err` → `connection._handleNetworkError(err)` path, so no new error-handling logic is required.\n\n### Verification\nDynamically confirmed on v3.23.0 (HEAD) using a minimal rogue \"MySQL server\" built on node-mysql2's own server-mode helpers (`mysql.createServer`, `Packets.Handshake`, `connection.writeOk()`). The rogue server completes a real handshake advertising `CLIENT_COMPRESS`, then writes one raw compressed frame (509,604 bytes on the wire — a zlib deflate of 500 MB of zero bytes, ratio 1028.8:1) directly to the socket. A normal `mysql.createConnection({ ..., compress: true })` victim client — which never issues any query — had its RSS grow from 74.3 MB to 1115.0 MB after receiving that single packet, before erroring out with `PROTOCOL_UNEXPECTED_PACKET` once the client tried to parse the inflated zero-filled buffer as MySQL packets. The memory allocation happens unconditionally before any content validation.","status":"published","published":"2026-08-31T22:36:20Z","modified":"2026-09-02T15:28:47Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-409"],"updated_at":"2026-11-02T14:41:10.121131Z"}],"osv":[{"id":"GHSA-3f6p-5ww8-9rcr","title":"MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials","description":"## Summary\n\nA rogue MySQL server (or MITM) can force mysql2 to send credentials in **plaintext** by requesting an auth switch to `mysql_clear_password`. The driver complies without verifying that TLS is active.\n\n## Details\n\n`mysql_clear_password` is registered as a default standard plugin in `lib/commands/auth_switch.js` (line 21). When a server sends an AuthSwitchRequest (0xFE) requesting `mysql_clear_password`, the driver executes it without checking for TLS. The plugin (`lib/auth_plugins/mysql_clear_password.js`) returns `Buffer.from(password + '\\0')`.\n\nNote: `caching_sha2_password` plugin DOES check for SSL before sending cleartext (line 77). But `mysql_clear_password` has no such guard.\n\n## Attack Scenario\n\n1. Attacker operates rogue MySQL server or performs MITM\n2. Server advertises `caching_sha2_password` in handshake\n3. Client sends hashed auth response\n4. Server replies with AuthSwitchRequest to `mysql_clear_password`\n5. Client sends password in plaintext\n6. Attacker captures plaintext password\n\n## PoC\n\nRogue MySQL server (Node.js, ~80 lines) that captures plaintext passwords from mysql2 clients. Tested against mysql2 3.20.0. Full PoC available on request.\n\n## Suggested Fix\n\nRemove `mysql_clear_password` from `standardAuthPlugins`, or add a guard requiring TLS/unix socket before allowing cleartext auth.\n\n## Impact\n\n- mysql2: 9M weekly downloads\n- Any application connecting without TLS is vulnerable to credential theft\n- Cloud environments with untrusted network paths are especially at risk","status":"published","published":"2026-09-01T16:40:34Z","modified":"2026-09-10T03:51:14.984267513Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T15:46:35.747385Z"},{"id":"GHSA-rgwj-5xj2-c3m3","title":"MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS","description":"## Vulnerability Details\n\n**File**: `lib/compressed_protocol.js`\n**Line**: 43 (`zlib.inflate(body, (err, data) =\u003e { ... })` inside `handleCompressedPacket`)\n\n### Root Cause\nWhen a connection is created with `compress: true` (and the server advertises `CLIENT_COMPRESS`), every incoming packet is unwrapped by `handleCompressedPacket()` in `lib/compressed_protocol.js`, which calls:\n\n```js\nzlib.inflate(body, (err, data) =\u003e { ... });\n```\n\nNo options object (in particular, no `maxOutputLength`) is passed. Node's zlib convenience methods default `maxOutputLength` to `buffer.kMaxLength`, which on this platform is `Number.MAX_SAFE_INTEGER` — i.e. effectively unbounded until the process runs out of memory. The 3-byte \"length of payload before compression\" field in the compressed-packet header is read (`packet.readInt24()`) but is only used to branch on `!== 0`; it is never used to cap or validate the actual inflate output size, and the real decompressed size is determined purely by the attacker-supplied deflate stream.\n\nBecause DEFLATE can reach compression ratios over 1000:1 for crafted repetitive input, an attacker who controls (or MITMs, on a non-TLS connection) the MySQL server endpoint can send a single small compressed packet that expands to gigabytes in the client's memory — a classic decompression-bomb / \"zip bomb\" applied to MySQL's client-compression protocol.\n\n### Attack Scenario\n1. Application connects with `mysql2`/`mysql2/promise` using `compress: true` (a documented option for reducing bandwidth, commonly used for cloud/WAN DB connections).\n2. The connection target is attacker-controlled or attacker-compromised, or an attacker MITMs a non-TLS connection.\n3. Right after authentication succeeds, the malicious endpoint sends one crafted compressed packet whose deflate stream is small on the wire (hundreds of KB) but decompresses to several GB.\n4. `zlib.inflate()` starts allocating memory for the full decompressed output with no ceiling.\n5. The Node.js process's RSS grows uncontrolled until OOM-kill or crash — no query needs to be issued by the client; the malicious packet alone is enough.\n\n### Impact\nDenial of Service of the client application (process crash / OOM) — not the database itself. No authentication bypass or data exposure. Requires `compress: true` plus a malicious/compromised server or MITM position.\n\n### Vulnerable Code\n```js\nfunction handleCompressedPacket(packet) {\n  const connection = this;\n  const deflatedLength = packet.readInt24();\n  const body = packet.readBuffer();\n\n  if (deflatedLength !== 0) {\n    connection.inflateQueue.push((task) =\u003e {\n      zlib.inflate(body, (err, data) =\u003e {\n        if (err) {\n          connection._handleNetworkError(err);\n          return;\n        }\n        connection._bumpCompressedSequenceId(packet.numPackets);\n        connection._inflatedPacketsParser.execute(data);\n        task.done();\n      });\n    });\n  } else {\n    ...\n  }\n}\n```\n\n### Recommended Fix\n```js\nconst MAX_INFLATED_PACKET_SIZE = 1 * 1024 * 1024 * 1024; // e.g. 1 GiB, ideally configurable\n\nzlib.inflate(body, { maxOutputLength: MAX_INFLATED_PACKET_SIZE }, (err, data) =\u003e {\n  if (err) {\n    connection._handleNetworkError(err);\n    return;\n  }\n  ...\n});\n```\n`maxOutputLength` makes `zlib.inflate` abort with `ERR_BUFFER_TOO_LARGE` as soon as the decompressed size would exceed the cap, routing into the exact same (already-existing) `err` → `connection._handleNetworkError(err)` path, so no new error-handling logic is required.\n\n### Verification\nDynamically confirmed on v3.23.0 (HEAD) using a minimal rogue \"MySQL server\" built on node-mysql2's own server-mode helpers (`mysql.createServer`, `Packets.Handshake`, `connection.writeOk()`). The rogue server completes a real handshake advertising `CLIENT_COMPRESS`, then writes one raw compressed frame (509,604 bytes on the wire — a zlib deflate of 500 MB of zero bytes, ratio 1028.8:1) directly to the socket. A normal `mysql.createConnection({ ..., compress: true })` victim client — which never issues any query — had its RSS grow from 74.3 MB to 1115.0 MB after receiving that single packet, before erroring out with `PROTOCOL_UNEXPECTED_PACKET` once the client tried to parse the inflated zero-filled buffer as MySQL packets. The memory allocation happens unconditionally before any content validation.","status":"published","published":"2026-08-31T22:36:20Z","modified":"2026-09-10T03:51:14.582598942Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-409"],"updated_at":"2026-11-02T15:46:55.877614Z"},{"id":"CLSA-2026-1788255454","title":"TuxCare security update for mysql2 (1 CVE)","description":"TuxCare rebuilt mysql2 to address 1 CVE. Fixed in 2.3.3-tuxcare.6.","status":"published","published":"2026-09-01T09:37:34Z","modified":"2026-10-15T09:47:55.335083231Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1790622749","title":"TuxCare security update for mysql2 (2 CVEs)","description":"TuxCare rebuilt mysql2 to address 2 CVEs. Fixed in 3.20.0-tuxcare.1.","status":"published","published":"2026-09-28T19:12:29Z","modified":"2026-10-15T09:47:19.934198185Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1792163478","title":"TuxCare security update for mysql2 (1 CVE)","description":"TuxCare rebuilt mysql2 to address 1 CVE. Fixed in 3.22.6-tuxcare.1.","status":"published","published":"2026-10-16T15:11:17Z","modified":"2026-10-16T16:31:47.476816992Z","updated_at":"2026-11-02T15:43:51.466048Z"},{"id":"CLSA-2026-1792472736","title":"TuxCare security update for mysql2 (1 CVE)","description":"TuxCare rebuilt mysql2 to address 1 CVE. Fixed in 3.22.4-tuxcare.1.","status":"published","published":"2026-10-20T05:05:36Z","modified":"2026-10-20T07:15:04.822741193Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792486376","title":"TuxCare security update for mysql2 (1 CVE)","description":"TuxCare rebuilt mysql2 to address 1 CVE. Fixed in 3.22.3-tuxcare.1.","status":"published","published":"2026-10-20T08:52:56Z","modified":"2026-10-20T13:45:11.061821083Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792489443","title":"TuxCare security update for mysql2 (2 CVEs)","description":"TuxCare rebuilt mysql2 to address 2 CVEs. Fixed in 3.15.3-tuxcare.1.","status":"published","published":"2026-10-20T09:44:03Z","modified":"2026-10-20T13:45:11.47074873Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792495278","title":"TuxCare security update for mysql2 (1 CVE)","description":"TuxCare rebuilt mysql2 to address 1 CVE. Fixed in 3.22.2-tuxcare.1.","status":"published","published":"2026-10-20T11:21:18Z","modified":"2026-10-20T13:45:17.973241183Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792506023","title":"TuxCare security update for mysql2 (1 CVE)","description":"TuxCare rebuilt mysql2 to address 1 CVE. Fixed in 3.22.1-tuxcare.1.","status":"published","published":"2026-10-20T14:20:23Z","modified":"2026-10-20T19:30:13.984887336Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"ROOT-APP-NPM-GHSA-3f6p-5ww8-9rcr","title":"GHSA-3f6p-5ww8-9rcr in mysql2 - Patched by Root","description":"Root has patched GHSA-3f6p-5ww8-9rcr in the mysql2 package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-28T09:08:17Z","modified":"2026-09-28T10:15:04.520233361Z","updated_at":"2026-11-02T15:53:27.940619Z"}]}}