{"id":"GHSA-5f7m-mmpc-qhh4","aliases":[],"status":"published","title":"mysql Node.JS Module Vulnerable to Remote Memory Exposure","description":"Versions of `mysql` before 2.14.0 are vulnerable to remove memory exposure.\n\nAffected versions of `mysql` package allocate and send an uninitialized memory over the network when a number is provided as a password.\n\nOnly `mysql` running on Node.js versions below 6.0.0 are affected due to a throw added in newer node.js versions.\n\nProof of Concept:\n\n```\nrequire('mysql').createConnection({\n  host: 'localhost',\n  user: 'user',\n  password : USERPROVIDEDINPUT,  // number\n  database : 'my_db'\n}).connect();\n```\n\n\n\n## Recommendation\n\nUpdate to version 2.14.0 or later.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-201"],"published":"2019-05-23T09:27:00Z","modified":"2023-01-11T05:08:06Z","fixes":[{"ecosystem":"npm","package":"mysql","fixed_in":["2.14.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0-alpha8"},{"fixed":"2.14.0"}]}]},{"source":"osv","ecosystem":"npm","package":"mysql","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0-alpha8"},{"fixed":"2.14.0"}]}]}],"references":[{"url":"https://github.com/mysqljs/mysql/commit/310c6a7d1b2e14b63b572dbfbfa10128f20c6d52","tags":["web"]},{"url":"https://www.npmjs.com/advisories/602","tags":["web"]},{"url":"https://github.com/mysqljs/mysql/commit/192fe45593ba5768534afb6f2154432ca67a5002","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5f7m-mmpc-qhh4"},{"url":"https://github.com/mysqljs/mysql","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-5f7m-mmpc-qhh4","title":"mysql Node.JS Module Vulnerable to Remote Memory Exposure","description":"Versions of `mysql` before 2.14.0 are vulnerable to remove memory exposure.\n\nAffected versions of `mysql` package allocate and send an uninitialized memory over the network when a number is provided as a password.\n\nOnly `mysql` running on Node.js versions below 6.0.0 are affected due to a throw added in newer node.js versions.\n\nProof of Concept:\n\n```\nrequire('mysql').createConnection({\n  host: 'localhost',\n  user: 'user',\n  password : USERPROVIDEDINPUT,  // number\n  database : 'my_db'\n}).connect();\n```\n\n\n\n## Recommendation\n\nUpdate to version 2.14.0 or later.","status":"published","published":"2019-05-23T09:27:00Z","modified":"2023-01-11T05:08:06Z","cwes":["CWE-201"],"updated_at":"2026-11-02T14:36:13.23016Z"}],"osv":[{"id":"GHSA-5f7m-mmpc-qhh4","title":"mysql Node.JS Module Vulnerable to Remote Memory Exposure","description":"Versions of `mysql` before 2.14.0 are vulnerable to remove memory exposure.\n\nAffected versions of `mysql` package allocate and send an uninitialized memory over the network when a number is provided as a password.\n\nOnly `mysql` running on Node.js versions below 6.0.0 are affected due to a throw added in newer node.js versions.\n\nProof of Concept:\n\n```\nrequire('mysql').createConnection({\n  host: 'localhost',\n  user: 'user',\n  password : USERPROVIDEDINPUT,  // number\n  database : 'my_db'\n}).connect();\n```\n\n\n\n## Recommendation\n\nUpdate to version 2.14.0 or later.","status":"published","published":"2019-05-23T09:27:00Z","modified":"2022-08-03T20:30:06Z","cwes":["CWE-201"],"updated_at":"2026-11-02T15:46:38.213481Z"}]}}