CVE-2026-107382
Description
A flaw was found in MariaDB Connector/Node.js. When establishing a secure Transport Layer Security (TLS) connection without a configured certificate authority and using Ed25519 authentication, the client attempts to access an out-of-scope variable during certificate fingerprint validation. A malicious server or network attacker presenting a self-signed certificate can trigger this flaw, causing an unhandled exception that terminates the Node.js application process and leads to a Denial of Service (DoS).
Statement
This vulnerability is evaluated as having Moderate impact because successful exploitation requires a specific combination of non-default connection parameters and results strictly in client process termination. An attacker or untrusted database server can only trigger the crash if the Node.js application connects over TCP with TLS enabled but lacks a designated Certificate Authority (CA) while negotiating Ed25519 authentication. Confidentiality and data integrity remain unaffected, as the failure does not allow remote code execution or credential disclosure. Deployments that supply a trusted CA certificate or employ standard alternative authentication plugins are not vulnerable to this issue.
Understanding the Weakness (CWE)
Availability,Confidentiality
Technical Impact: DoS: Crash, Exit, or Restart; Read Application Data
An uncaught exception could cause the system to be placed in a state that could lead to a crash, exposure of sensitive information, or other unintended behaviors.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
