CVE-2026-55855 mariadb-corporation CVE debrief

Who should care

Defenders responsible for Node.js applications that use MariaDB Connector/Node.js should assess exposure and apply patches. This includes reviewing the current version of the connector and updating it if necessary. Additionally, defenders should review database accounts and permissions, monitor database activity, and implement compensating controls as needed.

Why it matters

Defenders should prioritize verifying exposure and applying patches for MariaDB Connector/Node.js versions prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3 to prevent potential SQL injection attacks.

• Data exposure or modification due to successful exploitation.
• Potential for attackers to execute arbitrary SQL queries.

Technical summary

MariaDB Connector/Node.js is vulnerable to SQL injection when attacker-controlled Buffer parameters are escaped client-side under certain character sets. The issue is fixed in versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3. The vulnerability arises from improper escaping logic in lib/io/packet-output-stream.js, which does not use charset-aware getMbRecognizer logic from lib/misc/charset-mb.js. This allows an attacker-controlled lead byte to be consumed as a multibyte trail byte, leaving the following quote unescaped and enabling arbitrary SQL execution.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for MariaDB Connector/Node.js versions prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3.

Recommended defensive actions

• Verify the version of MariaDB Connector/Node.js in use and update to 3.2.4, 3.3.3, 3.4.6, or 3.5.3 if necessary.
• Review database accounts and permissions to ensure that they follow the principle of least privilege.
• Monitor database activity for suspicious queries.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the SQL injection vulnerability in MariaDB Connector/Node.js. The issue is fixed in versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3. Evidence from the CVE record indicates that attacker-controlled Buffer parameters can be used for SQL injection under specific character sets. The NVD entry also confirms the vulnerability and provides additional context on the affected versions and potential impacts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.