Product
The mysql2 Node.js database driver is vulnerable to credential theft because it does not enforce TLS before executing a requested authentication switch to the mysql_clear_password plugin.