Summary
MariaDB Connector/Node.js can disclose uninitialized Node.js heap memory when malformed GeoJSON Polygon or MultiPolygon data is processed by its binary encoders. An attacker who can supply a non-array ring to an application using execute() or batch() may cause sensitive memory contents to be written into a database value.
MariaDB Connector/Node.js can disclose uninitialized Node.js heap memory when malformed GeoJSON Polygon or MultiPolygon data is processed by its binary encoders. An attacker who can supply a non-array ring to an application using execute() or batch() may cause sensitive memory contents to be written into a database value.
Affected context
The issue occurs in MariaDB Connector/Node.js GeoJSON binary encoding for Polygon and MultiPolygon values when affected connector versions process malformed ring structures. The vulnerable behavior applies to the binary parameter paths used by execute() and batch(); the text-protocol query() path is not affected. Risk depends on an application accepting attacker-influenced geometry data and passing it to these APIs.
The issue occurs in MariaDB Connector/Node.js GeoJSON binary encoding for Polygon and MultiPolygon values when affected connector versions process malformed ring structures. The vulnerable behavior applies to the binary parameter paths used by execute() and batch(); the text-protocol query() path is not affected. Risk depends on an application accepting attacker-influenced geometry data and passing it to these APIs.
Exploit preconditions
- Attack surface: Node.js application code that encodes GeoJSON Polygon or MultiPolygon values
- Required access: Ability to provide or influence malformed geometry input, typically through an application-facing data or API path
- Trigger point: Binary encoding of a Polygon or MultiPolygon parameter before an
execute()orbatch()operation - Why exploitation is possible: The encoder sizes an unsafe buffer using a ring's numeric length before confirming that the ring is an array, then sends the complete buffer even when portions were not written
- Attack surface: Node.js application code that encodes GeoJSON Polygon or MultiPolygon values
- Required access: Ability to provide or influence malformed geometry input, typically through an application-facing data or API path
- Trigger point: Binary encoding of a Polygon or MultiPolygon parameter before an
execute()orbatch()operation - Why exploitation is possible: The encoder sizes an unsafe buffer using a ring's numeric length before confirming that the ring is an array, then sends the complete buffer even when portions were not written
Why this happens
The underlying bug is an unsafe memory-initialization and input-validation sequence. The encoder allocates storage with Buffer.allocUnsafe() based on attacker-influenced metadata, validates the ring type too late, and allows unwritten buffer regions to remain part of the serialized database value.
This maps to CWE-200: Exposure of Sensitive Information, because bytes from process memory can cross the application and database trust boundary. The insecure pattern combines unchecked input-derived sizing, unsafe allocation, and transmission of data that was not explicitly initialized.
The underlying bug is an unsafe memory-initialization and input-validation sequence. The encoder allocates storage with Buffer.allocUnsafe() based on attacker-influenced metadata, validates the ring type too late, and allows unwritten buffer regions to remain part of the serialized database value.
This maps to CWE-200: Exposure of Sensitive Information, because bytes from process memory can cross the application and database trust boundary. The insecure pattern combines unchecked input-derived sizing, unsafe allocation, and transmission of data that was not explicitly initialized.
Potential impact
- Uninitialized Node.js heap data may be disclosed in database values
- Database records may contain other users' content or session material
- Database credentials or TLS key material could be exposed
- Sensitive values may propagate to replicas, backups, exports, or downstream analytics
- Affected data could increase the impact of subsequent account or infrastructure compromise
- Uninitialized Node.js heap data may be disclosed in database values
- Database records may contain other users' content or session material
- Database credentials or TLS key material could be exposed
- Sensitive values may propagate to replicas, backups, exports, or downstream analytics
- Affected data could increase the impact of subsequent account or infrastructure compromise
General mitigation guidance
Mitigation generally focuses on ensuring that serialized output contains only validated and explicitly initialized data.
Common defensive patterns include:
- Validate GeoJSON structure and ring types before calculating sizes or allocating buffers
- Use initialized allocation or explicitly initialize every output region before transmission
- Reject malformed geometry rather than attempting partial encoding
- Ensure serialized lengths are derived from validated structures and match the bytes actually written
- Prefer safer serialization abstractions that do not expose uninitialized memory
- Reduce trust in client-provided geometry through schema validation and application-level constraints
- Apply least-privilege database credentials and restrict access to sensitive records, backups, and replicas
Mitigation generally focuses on ensuring that serialized output contains only validated and explicitly initialized data.
Common defensive patterns include:
- Validate GeoJSON structure and ring types before calculating sizes or allocating buffers
- Use initialized allocation or explicitly initialize every output region before transmission
- Reject malformed geometry rather than attempting partial encoding
- Ensure serialized lengths are derived from validated structures and match the bytes actually written
- Prefer safer serialization abstractions that do not expose uninitialized memory
- Reduce trust in client-provided geometry through schema validation and application-level constraints
- Apply least-privilege database credentials and restrict access to sensitive records, backups, and replicas
How teams detect issues like this
Organizations can look for:
- Static analysis findings involving
Buffer.allocUnsafe()near input-derived size calculations - Code review signals where type validation occurs after allocation or serialization sizing
- Tests using malformed Polygon and MultiPolygon rings, including non-array and inconsistent-length values
- Assertions that encoded lengths equal the number of initialized bytes written
- Database monitoring for unexpected binary geometry values or sensitive-looking content in geometry columns
- Policy checks requiring schema validation before serialization and prohibiting transmission of partially initialized buffers
Automated code review and security scanning tools may help identify unsafe allocation and incomplete input-validation patterns.
Organizations can look for:
- Static analysis findings involving
Buffer.allocUnsafe()near input-derived size calculations - Code review signals where type validation occurs after allocation or serialization sizing
- Tests using malformed Polygon and MultiPolygon rings, including non-array and inconsistent-length values
- Assertions that encoded lengths equal the number of initialized bytes written
- Database monitoring for unexpected binary geometry values or sensitive-looking content in geometry columns
- Policy checks requiring schema validation before serialization and prohibiting transmission of partially initialized buffers
Automated code review and security scanning tools may help identify unsafe allocation and incomplete input-validation patterns.
