mysql2 npm Package Vulnerability: Potential Plaintext Credential Leak
- Severity
- HIGH
- Affected component
- mysql2 (npm)
- Affected versions
- < 3.22.0 or < 3.9.4 or < 3.9.7 or < 3.9.4 or < 3.9.3 or < 3.9.8 or < 3.23.1
- Patched version
- Not yet available
An early warning has been issued regarding a vulnerability in the mysql2 npm package that could potentially leak plaintext credentials. Users of affected versions should take immediate action.
What happened
An early warning has been issued for a vulnerability in the mysql2 npm package. This vulnerability, tracked as GHSA-3F6P-5WW8-9RCR, reportedly allows a rogue MySQL server to force mysql2 to send credentials in plaintext by requesting an authentication switch to `mysql_clear_password`. The driver complies with this request without verifying that TLS is active. This could result in the leakage of plaintext credentials.
The vulnerability affects versions of mysql2 less than 3.22.0, 3.9.4, 3.9.7, 3.9.3, 3.9.8, and 3.23.1. It is important to note that this is an early warning and the situation is under investigation. The vulnerability has not been exploited in the wild as of the latest reports.
What to do about it
- Remove `mysql_clear_password` from `standardAuthPlugins` in your configuration.
- Add a guard requiring TLS or a unix socket before allowing cleartext authentication.
- Monitor the primary sources for updates on this vulnerability.
- Consider upgrading to a version of mysql2 that is not affected if a patched version becomes available.
How 0Day would have caught this
mysql2 is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using mysql2 npm package versions less than 3.22.0, 3.9.4, 3.9.7, 3.9.3, 3.9.8, or 3.23.1.
What should I do right now?
Remove `mysql_clear_password` from `standardAuthPlugins` and add a guard requiring TLS or a unix socket before allowing cleartext authentication. Monitor the primary sources for updates.
Is there an official fix available?
No official fix has been published yet. Monitor the sources for updates.