Because the connector returns the entire buffer regardless of the write progress, the uninitialized heap memory remains in the returned buffer and is subsequently written to the database. This memory can contain sensitive data from the Node.js process, including other users' request/response bodies, session tokens, cookies, database credentials, and TLS key material. The issue affects all versions prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4. The text-based query() method is not affected.

Impact

Successful exploitation results in the silent exfiltration of sensitive process heap data directly into the database. Because the leaked data is persisted in rows, backups, and replicas, it remains accessible to any entity with read permissions for the affected tables. This vulnerability poses a high risk to applications handling map or location data where attacker-supplied GeoJSON objects are processed by the connector.

Recommendation

• Upgrade to MariaDB Connector/Node.js version 3.2.5, 3.3.4, 3.4.7, 3.5.4, or later to implement proper validation of GeoJSON ring types.
• Implement application-level input validation to ensure that all GeoJSON coordinate properties are correctly structured arrays before passing them to execute() or batch() methods.
• Transition from execute() or batch() to the query() method for operations involving GeoJSON parameters if immediate patching is not feasible, as the text-based encoder is not impacted by this heap disclosure.
• Audit database tables containing data populated by vulnerable versions of the connector to identify potentially leaked sensitive information.