CVE-2026-107383

Summary

MariaDB Connector/Node.js has a buffer overflow vulnerability where uninitialized heap data gets leaked into database values when processing GeoJSON polygon and multipolygon data. This occurs because the code allocates memory based on array length before validating that the data is actually an array, potentially exposing sensitive information like session tokens, credentials, or TLS keys.

Exploitability

Exploitation requires a malicious GeoJSON polygon or multipolygon input that can be processed by the connector, with no additional preconditions needed beyond having the vulnerable version installed.

Blast radius

The vulnerability could expose sensitive data across multiple users and systems since the leaked heap data may include session material, database credentials, or TLS key material that gets persisted to backups and replicas.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to MariaDB Connector/Node.js version 3.2.5, 3.3.4, 3.4.7, or 3.5.4 immediately.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.