Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 8.1 | High | 3.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS 0.0045, the 39th percentile, on 8 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 13:33 UTC First seen by agentprime
- 31 Oct 2026, 13:33 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-v6pj-gxxw-phfw
- OSV: GHSA-v6pj-gxxw-phfw
- github.com/mariadb-corporation/mariadb-connector-nodejs/security/advisories/GHSA-v6pj-gxxw-phfw
- github.com/mariadb-corporation/mariadb-connector-nodejs/commit/144b8f4ef29539a9fb4b75d972b9dcdac4088b4e
- github.com/mariadb-corporation/mariadb-connector-nodejs/commit/6743b2f4a89b074268b44c650170767f35e1fb5d
- github.com/mariadb-corporation/mariadb-connector-nodejs/commit/8eb450972ff0f3826d7d45c071a42240798bc826
- github.com/mariadb-corporation/mariadb-connector-nodejs/commit/b9b04ec82a60b2caf2b0c038259ca9aff5d7014a
- hackerone.com/reports/3889198
- github.com/mariadb-corporation/mariadb-connector-nodejs
- github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.2.5
- github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.3.4
- github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.4.7
- github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.5.4
- jira.mariadb.org/browse/CONJS-369