Detections
Analytics

Node.js Module mariadb < 3.2.4 / 3.3.3 / 3.4.6 / 3.5.3 Information Disclosure

high Nessus Plugin ID 342635

Synopsis

A module in the Node.js JavaScript run-time environment is affected by an information disclosure vulnerability.

Description

The version of the MariaDB Connector/Node.js (mariadb) module detected on the host is prior to 3.2.4, 3.3.3, 3.4.6, or 3.5.3. It is, therefore, affected by an information disclosure vulnerability. When SSL/TLS is enabled but no CA or server certificate is provided, the connector validates the server identity by fingerprint only after the authentication exchange, so credentials are transmitted before validation occurs. An active man-in-the-middle can capture those credentials.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to mariadb version 3.2.4 / 3.3.3 / 3.4.6 / 3.5.3 or later.

See Also

https://github.com/advisories/GHSA-cqhc-2h57-wpxf

Plugin Details

Severity: High

ID: 342635

File Name: nodejs_module_mariadb_CVE-2026-55215.nasl

Version: 1.1

Type: Local

Agent: windows, macosx, unix

Family: Misc.

Published: 9/3/2026

Updated: 9/3/2026

Configuration: Enable thorough checks (optional)

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.65

CVSS v2

Risk Factor: High

Base Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2026-55215

CVSS v3

Risk Factor: High

Base Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Vulnerability Information

CPE: cpe:/a:mariadb:connector_nodejs

Required KB Items: installed_sw/Node.js, Host/nodejs/modules/enumerated

Patch Publication Date: 8/28/2026

Vulnerability Publication Date: 8/28/2026

Reference Information

CVE: CVE-2026-55215

CWE: 295, 522