{"vulnerability": "CVE-2026-5585", "sightings": [{"uuid": "e0350ffb-b79e-424b-90bc-1e60f2cb0b03", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5585", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mirk2ur7di2q", "content": "", "creation_timestamp": "2026-04-05T20:00:49.997621Z"}, {"uuid": "90869421-79f4-4f59-bb36-b92b6e07c3b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55852", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdpfpffy72f", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-55852 \u0432 Frappe: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/9BA73DA6-ED3C-49E2-8A78-9F3FBAB480B7", "creation_timestamp": "2026-07-11T03:20:38.720519Z"}, {"uuid": "1bd87355-028f-4d65-81de-0ccbf67a779a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55857", "type": "seen", "source": "https://gist.github.com/alon710/3380ae01f52344248b245161333046b0", "content": "# CVE-2026-55857: CVE-2026-55857: Insecure Credential Transmission via PAM Dialog Plugin in MariaDB Connector/J\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-08-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55857\n\n## Summary\nA transport-security omission in the MariaDB Connector/J driver allows remote on-path adversaries or rogue database servers to capture database credentials in cleartext. Under default configurations (sslMode=DISABLE), the driver fails to enforce encrypted channels when negotiating the Pluggable Authentication Module (PAM) 'dialog' plugin, resulting in cleartext transmission of sensitive passwords.\n\n## TL;DR\nMariaDB Connector/J fails to enforce TLS/SSL when negotiating the PAM 'dialog' authentication plugin. An attacker with on-path network access or running a rogue database server can trigger an authentication switch to 'dialog' and harvest the database password in plaintext.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-319: Cleartext Transmission of Sensitive Information\n- **Attack Vector**: Network (AV:N)\n- **Attack Complexity**: High (AC:H)\n- **CVSS Base Score**: 5.9 (Medium)\n- **Impact**: High Confidentiality Loss (C:H)\n- **Exploit Status**: poc\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications utilizing MariaDB Connector/J (mariadb-java-client) to connect to MariaDB or MySQL servers.\n- **mariadb-connector-j**: < 2.7.14 (Fixed in: `2.7.14`)\n- **mariadb-connector-j**: >= 3.0.0, < 3.3.5 (Fixed in: `3.3.5`)\n- **mariadb-connector-j**: >= 3.4.0, < 3.4.3 (Fixed in: `3.4.3`)\n- **mariadb-connector-j**: >= 3.5.0, < 3.5.9 (Fixed in: `3.5.9`)\n\n## Mitigation\n\n- Upgrade the MariaDB Connector/J dependency to a patched version (2.7.14, 3.3.5, 3.4.3, or 3.5.9).\n- Configure the JDBC connection string with sslMode=verify-full or sslMode=verify-ca to prevent on-path connection tampering.\n- Restrict allowed client-side authentication mechanisms via the restrictedAuth parameter to exclude 'dialog'.\n\n**Remediation Steps:**\n1. Identify all internal applications importing org.mariadb.jdbc:mariadb-java-client.\n2. Update the project build files (pom.xml, build.gradle) to reference the corresponding secure release (e.g., 3.5.9).\n3. For applications that cannot be immediately updated, append restrictedAuth=mysql_native_password to the JDBC connection string.\n4. Ensure production environment database connection strings do not use sslMode=DISABLE or sslMode=trust over public or untrusted networks.\n\n## References\n\n- [GHSA-qxvw-fvwx-5cp7 Advisory](https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-qxvw-fvwx-5cp7)\n- [MariaDB JIRA CONJ-1320 Ticket](https://jira.mariadb.org/browse/CONJ-1320)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55857) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-29T04:33:12.849687Z"}, {"uuid": "1fa4602d-e29e-4ac1-acc0-705ad119f224", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55855", "type": "seen", "source": "https://gist.github.com/alon710/6f86711971bb7ed1944c7170d2f2eeef", "content": "# CVE-2026-55855: CVE-2026-55855: SQL Injection in MariaDB Connector/Node.js via Multi-byte Client Character Sets\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-08-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55855\n\n## Summary\nCVE-2026-55855 is a client-side SQL injection vulnerability in the MariaDB Connector/Node.js library that occurs when using legacy multi-byte character sets. The flaw arises from naive, byte-wise client-side parameter escaping. Attackers can leverage specific multi-byte lead bytes to absorb backslash escape characters on the server side, allowing them to terminate string literals and execute arbitrary SQL commands.\n\n## TL;DR\nA client-side escaping flaw in MariaDB's Node.js driver allows SQL injection when using legacy multi-byte encodings (e.g., GBK, BIG5). Upgrading or switching to utf8mb4 mitigates the issue.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-89 / CWE-116\n- **Attack Vector**: Network\n- **CVSS Severity**: 6.5 (Medium)\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n- **Impact**: Client-Side SQL Injection Bypass\n\n## Affected Systems\n\n- mariadb-connector-nodejs\n- **mariadb-connector-nodejs**: < 3.2.4 (Fixed in: `3.2.4`)\n- **mariadb-connector-nodejs**: >= 3.3.0, < 3.3.3 (Fixed in: `3.3.3`)\n- **mariadb-connector-nodejs**: >= 3.4.0, < 3.4.6 (Fixed in: `3.4.6`)\n- **mariadb-connector-nodejs**: >= 3.5.0, < 3.5.3 (Fixed in: `3.5.3`)\n\n## Mitigation\n\n- Upgrade the mariadb-connector-nodejs package to patched releases.\n- Enforce standard utf8mb4 encoding on the client connection.\n- Use server-side prepared statements via conn.execute() instead of text queries.\n\n**Remediation Steps:**\n1. Identify vulnerable installations by inspecting package-lock.json for the 'mariadb' dependency.\n2. Run 'npm install mariadb@latest' to resolve dependencies to versions 3.2.4, 3.3.3, 3.4.6, or 3.5.3 depending on the tracking branch.\n3. Modify database connection configurations to default to utf8mb4 rather than legacy encodings.\n4. Refactor usage of conn.query() to conn.execute() for parameterized database queries.\n\n## References\n\n- [Advisory GHSA-g5xc-5w98-jfvm](https://github.com/mariadb-corporation/mariadb-connector-nodejs/security/advisories/GHSA-g5xc-5w98-jfvm)\n- [Issue CONJS-350](https://jira.mariadb.org/browse/CONJS-350)\n- [CVE-2026-55855](https://www.cve.org/CVERecord?id=CVE-2026-55855)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55855) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-28T23:31:57.464877Z"}, {"uuid": "76b7bbd2-7af3-4a5f-8e27-7c0af3aa38a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55856", "type": "seen", "source": "https://gist.github.com/alon710/b4396cc6c765460048e24f2b654c8aa9", "content": "# CVE-2026-55856: CVE-2026-55856: Credential Disclosure via Out-of-Order Handshake in MariaDB Connector/J\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-08-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55856\n\n## Summary\nA critical credential disclosure vulnerability in MariaDB Connector/J allows remote attackers to capture raw database passwords. The driver transmits plaintext passwords prior to verifying TLS certificate fingerprints when configured in ephemeral trust fallback states.\n\n## TL;DR\nMariaDB Connector/J allows a Man-in-the-Middle attacker to intercept and steal plaintext database passwords because the driver transmits authentication responses during initial handshakes before enforcing certificate fingerprint verification checks.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-522\n- **Attack Vector**: Network\n- **Attack Complexity**: High\n- **Privileges Required**: None\n- **CVSS v3.1 Score**: 5.9 (Medium)\n- **Exploit Status**: Proof of Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- MariaDB Connector/J Java driver\n- **MariaDB Connector/J**: < 2.7.14 (Fixed in: `2.7.14`)\n- **MariaDB Connector/J**: >= 3.3.0, < 3.3.5 (Fixed in: `3.3.5`)\n- **MariaDB Connector/J**: >= 3.4.0, < 3.4.3 (Fixed in: `3.4.3`)\n- **MariaDB Connector/J**: >= 3.5.0, < 3.5.9 (Fixed in: `3.5.9`)\n\n## Mitigation\n\n- Upgrade MariaDB Connector/J dependencies to fixed versions.\n- Explicitly configure trusted certificates on client connections using the serverSslCert parameter.\n- Supply custom JVM trust stores to connections to disable ephemeral fallback trust managers.\n\n**Remediation Steps:**\n1. Locate Maven, Gradle, or manual jar configurations referencing vulnerable MariaDB Connector/J packages.\n2. Replace vulnerable versions with patched releases: 2.7.14, 3.3.5, 3.4.3, or 3.5.9.\n3. Update database connection strings to supply valid server certificates if using verify-ca or verify-full sslModes.\n\n## References\n\n- [NVD CVE-2026-55856](https://nvd.nist.gov/vuln/detail/CVE-2026-55856)\n- [GitHub Advisory GHSA-g9jj-cgmh-9f38](https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-g9jj-cgmh-9f38)\n- [MariaDB Jira Tracking Ticket CONJ-1325](https://jira.mariadb.org/browse/CONJ-1325)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55856) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-29T05:32:06.191781Z"}, {"uuid": "2c36c85c-c108-407a-9427-0fb59c9ec7a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55859", "type": "seen", "source": "https://gist.github.com/alon710/dd09c3ef696a75a72346fac91d4e54bd", "content": "# CVE-2026-55859: CVE-2026-55859: Client-Server Charset Confusion in MariaDB Connector/R2DBC leading to SQL Injection\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-08-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55859\n\n## Summary\nAn input validation and encoding desynchronization vulnerability exists in MariaDB Connector/R2DBC versions prior to 1.4.1. The driver assumes all communication utilizes the UTF-8 character set, but fails to account for server-driven mid-session changes to the character_set_client variable. When a change to a multi-byte character set such as GBK or Big5 is induced, the server interprets client-escaped single quotes as part of a multi-byte character. This state desynchronization bypasses standard escaping mechanisms and allows remote unauthenticated attackers to execute arbitrary SQL commands.\n\n## TL;DR\nA charset desynchronization vulnerability in MariaDB Connector/R2DBC allows attackers to bypass SQL character escaping and execute arbitrary database queries.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-116, CWE-838\n- **Attack Vector**: Network\n- **Complexity**: High\n- **CVSS Score**: 5.9\n- **Impact**: Integrity (SQL Injection)\n- **Exploit Status**: Conceptual / PoC\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- MariaDB Connector/R2DBC\n- **MariaDB Connector/R2DBC**: < 1.4.1 (Fixed in: `1.4.1`)\n\n## Mitigation\n\n- Upgrade MariaDB Connector/R2DBC to version 1.4.1 or higher.\n- Enforce TLS (sslMode=VERIFY_CA/VERIFY_FULL) to prevent MITM charset-tracking packet modification.\n- Restrict execution of stored procedures and triggers that modify server variables dynamically.\n\n**Remediation Steps:**\n1. Identify any Maven or Gradle dependency references to org.mariadb:r2dbc-mariadb.\n2. Update dependency version declaration to 1.4.1 or higher.\n3. Deploy application with upgraded libraries.\n4. Configure database connection pools to enforce TLS verification to counter MITM vectors.\n\n## References\n\n- [GitHub Security Advisory GHSA-5rqc-86vf-g8r2](https://github.com/mariadb-corporation/mariadb-connector-r2dbc/security/advisories/GHSA-5rqc-86vf-g8r2)\n- [MariaDB JIRA Bug Ticket R2DBC-124](https://jira.mariadb.org/browse/R2DBC-124)\n- [Official Release Announcement 1.4.1](https://github.com/mariadb-corporation/mariadb-connector-r2dbc/releases/tag/1.4.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55859) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-29T02:32:11.153666Z"}, {"uuid": "d4770fde-0ad8-4c8f-9d2c-5704d070ab17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55855", "type": "seen", "source": "https://gist.github.com/alon710/6f86711971bb7ed1944c7170d2f2eeef", "content": "# CVE-2026-55855: CVE-2026-55855: SQL Injection in MariaDB Connector/Node.js via Multi-byte Client Character Sets\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-08-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55855\n\n## Summary\nCVE-2026-55855 is a client-side SQL injection vulnerability in the MariaDB Connector/Node.js library that occurs when using legacy multi-byte character sets. The flaw arises from naive, byte-wise client-side parameter escaping. Attackers can leverage specific multi-byte lead bytes to absorb backslash escape characters on the server side, allowing them to terminate string literals and execute arbitrary SQL commands.\n\n## TL;DR\nA client-side escaping flaw in MariaDB's Node.js driver allows SQL injection when using legacy multi-byte encodings (e.g., GBK, BIG5). Upgrading or switching to utf8mb4 mitigates the issue.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-89 / CWE-116\n- **Attack Vector**: Network\n- **CVSS Severity**: 6.5 (Medium)\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n- **Impact**: Client-Side SQL Injection Bypass\n\n## Affected Systems\n\n- mariadb-connector-nodejs\n- **mariadb-connector-nodejs**: < 3.2.4 (Fixed in: `3.2.4`)\n- **mariadb-connector-nodejs**: >= 3.3.0, < 3.3.3 (Fixed in: `3.3.3`)\n- **mariadb-connector-nodejs**: >= 3.4.0, < 3.4.6 (Fixed in: `3.4.6`)\n- **mariadb-connector-nodejs**: >= 3.5.0, < 3.5.3 (Fixed in: `3.5.3`)\n\n## Mitigation\n\n- Upgrade the mariadb-connector-nodejs package to patched releases.\n- Enforce standard utf8mb4 encoding on the client connection.\n- Use server-side prepared statements via conn.execute() instead of text queries.\n\n**Remediation Steps:**\n1. Identify vulnerable installations by inspecting package-lock.json for the 'mariadb' dependency.\n2. Run 'npm install mariadb@latest' to resolve dependencies to versions 3.2.4, 3.3.3, 3.4.6, or 3.5.3 depending on the tracking branch.\n3. Modify database connection configurations to default to utf8mb4 rather than legacy encodings.\n4. Refactor usage of conn.query() to conn.execute() for parameterized database queries.\n\n## References\n\n- [Advisory GHSA-g5xc-5w98-jfvm](https://github.com/mariadb-corporation/mariadb-connector-nodejs/security/advisories/GHSA-g5xc-5w98-jfvm)\n- [Issue CONJS-350](https://jira.mariadb.org/browse/CONJS-350)\n- [CVE-2026-55855](https://www.cve.org/CVERecord?id=CVE-2026-55855)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55855) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-29T00:00:52.230101Z"}, {"uuid": "1a4c342a-c686-4b97-b541-76c39c7fc2d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55858", "type": "seen", "source": "https://gist.github.com/alon710/8d1aa47ee5a874bddf01dd7e56e42801", "content": "# CVE-2026-55858: CVE-2026-55858: Client/Server Charset-Confusion SQL Injection in MariaDB Connector/J\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-08-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55858\n\n## Summary\nCVE-2026-55858 describes a critical encoding desynchronization vulnerability in MariaDB Connector/J (the official JDBC driver). The vulnerability stems from a mismatch between the driver's static UTF-8 client-side escaping logic and dynamic character set changes initiated on the database server. When the server character set is switched mid-session to an encoding that permits ASCII-overlapping multibyte characters (such as GBK or Big5), an attacker can supply crafted inputs to swallow escaping backslashes, resulting in SQL injection and unauthorized statement execution.\n\n## TL;DR\nMariaDB Connector/J assumes the connection charset remains UTF-8. If a server-side charset switch (e.g., via 'SET NAMES') changes this to a non-UTF-8 multibyte charset (like GBK), the client's escaping logic can be bypassed using backslash-swallowing techniques, allowing SQL injection.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **Vulnerability ID**: CVE-2026-55858 / GHSA-xvr9-35cr-46v9\n- **CWE ID**: CWE-838: Inappropriate Encoding for Output Context\n- **CVSS v3.1 Score**: 5.9 (Medium)\n- **Attack Vector**: Network (AV:N)\n- **Attack Complexity**: High (AC:H)\n- **Exploit Status**: Proof of Concept (PoC) available\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications utilizing MariaDB Connector/J (mariadb-java-client) running against MySQL or MariaDB database servers with multibyte character configurations.\n- **mariadb-connector-j**: < 2.7.14 (Fixed in: `2.7.14`)\n- **mariadb-connector-j**: >= 3.0.0-alpha, < 3.3.5 (Fixed in: `3.3.5`)\n- **mariadb-connector-j**: >= 3.4.0, < 3.4.3 (Fixed in: `3.4.3`)\n- **mariadb-connector-j**: >= 3.5.0, < 3.5.9 (Fixed in: `3.5.9`)\n\n## Mitigation\n\n- Upgrade the MariaDB Connector/J dependency to a patched version immediately.\n- Enforce strict server-side configuration parameters to disallow non-UTF-8 client session charsets.\n- Restrict user permissions on the execution of the SET NAMES statement in the database engine.\n\n**Remediation Steps:**\n1. Identify all internal applications and services utilizing the 'org.mariadb.jdbc:mariadb-java-client' dependency.\n2. Update Maven, Gradle, or manual build configurations to reference one of the patched versions: 2.7.14, 3.3.5, 3.4.3, or 3.5.9.\n3. Rebuild and redeploy the affected applications into staging environment and execute regression suite.\n4. Deploy the updated application build to production environments and verify that dynamic charset configuration modifications are blocked and result in a SQLNonTransientConnectionException.\n\n## References\n\n- [NVD CVE-2026-55858 Detail Page](https://nvd.nist.gov/vuln/detail/CVE-2026-55858)\n- [MariaDB Jira Bug Ticket CONJ-1317](https://jira.mariadb.org/browse/CONJ-1317)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55858) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-29T03:32:23.035671Z"}, {"uuid": "43f1f7d1-1adc-4061-b258-feef831d5cfc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55854", "type": "seen", "source": "https://gist.github.com/alon710/5f232ba94d0a0fcc67abaad39f7d78cc", "content": "# CVE-2026-55854: CVE-2026-55854: Cleartext Credential Disclosure in MariaDB Connector/Node.js via Coerced Authentication Switch\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-08-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55854\n\n## Summary\nCVE-2026-55854 identifies a critical security flaw in the MariaDB Connector for Node.js (mariadb npm package). When establishing connections, the driver fails to validate transport security requirements during Pluggable Authentication Modules (PAM) dialog authentication. This vulnerability allows active on-path attackers or malicious database servers to coerce the client driver into transmitting user credentials in cleartext over unencrypted TCP connections.\n\n## TL;DR\nThe MariaDB Connector for Node.js fails to verify TLS or local transport security before performing PAM dialog authentication, allowing on-path attackers to capture database passwords in cleartext.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-319, CWE-522\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 5.9 (Medium)\n- **EPSS Score**: 0.00278\n- **Impact**: High Confidentiality Compromise (Credential Disclosure)\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- MariaDB Connector/Node.js (mariadb npm package)\n- **mariadb**: < 3.2.4 (Fixed in: `3.2.4`)\n- **mariadb**: >= 3.3.0, < 3.3.3 (Fixed in: `3.3.3`)\n- **mariadb**: >= 3.4.0, < 3.4.6 (Fixed in: `3.4.6`)\n- **mariadb**: >= 3.5.0, < 3.5.3 (Fixed in: `3.5.3`)\n\n## Mitigation\n\n- Upgrade the mariadb npm package to secure patched versions (3.2.4, 3.3.3, 3.4.6, or 3.5.3).\n- Enforce strict TLS configuration with rejectUnauthorized: true to block man-in-the-middle proxying.\n- Use local Unix domain sockets instead of unencrypted TCP loops for same-host database deployments.\n\n**Remediation Steps:**\n1. Run 'npm install mariadb@3.5.3' or the corresponding patch level for your current major release branch.\n2. Audit existing connection configuration files to ensure ssl properties are explicitly defined and validate the CA chain.\n3. Implement static analysis (Semgrep) in application pipelines to identify connection objects that disable SSL or certificate authorization.\n\n## References\n\n- [NVD Reference](https://nvd.nist.gov/vuln/detail/CVE-2026-55854)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-55854)\n- [GitHub Security Advisory](https://github.com/mariadb-corporation/mariadb-connector-nodejs/security/advisories/GHSA-42r5-vhpq-m858)\n- [MariaDB Jira Bug Tracker](https://jira.mariadb.org/browse/CONJS-353)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55854) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-29T16:31:36.610023Z"}]}