7.5

CVE-2026-107383: MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters

Awaiting analysis
AliasesCGA-8694-49r8-h5qmCGA-p4jc-hgfj-gvv6CGA-q8fp-x39x-8fpp
Published 08-10-2026Last modified 14-10-2026

Vulnerability summary

CVE-2026-107383 is a high (CVSS 7.5) vulnerability in mariadb-corporation mariadb-connector-nodejs. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 32.9% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 0% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
0.39%
0%100%
Low · Change unavailable
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Timeline

  1. 08-10-2026
    PublishedVulnerability first disclosed.
  2. 14-10-2026
    Last modifiedVulnerability information updated.

Description

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, the GeoJSON Polygon and MultiPolygon binary encoders size a Buffer.allocUnsafe() allocation from each ring's numeric length before confirming that the ring is an array. A malformed non-array ring can therefore reserve bytes that the writing loop skips, and the connector sends the full buffer through execute() or batch(), disclosing uninitialized Node.js heap data into a database value. The persisted data can include other users' content, session material, database credentials, or TLS key material and may propagate to backups and replicas. The text-protocol query() path is not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.39%

Chance of exploitation in the next 30 days

Percentile

33%

Versus all other CVEs

30-day change

Change unavailable

Change unavailable

09-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard1 product
  • sqlpadAll versions (No fix recorded) | < 7.5.7-r49
Mariadb-corporation1 product
Npm1 product
  • mariadb< 3.2.5 | ≥ 3.3.0, < 3.3.4 | ≥ 3.4.0, < 3.4.7 | ≥ 3.5.0-rc.0, < 3.5.4
Wolfi1 product
  • sqlpadAll versions (No fix recorded) | < 7.5.7-r49

4 vendors · 4 products

References

13 links
Show all 13 references