CVE-2026-55855

MEDIUMPre-NVD 6.56.5—
EchelonGraph scoreMEDIUM confidence

This medium-severity CVE scores 6.5 under a secondary CVSS source (NVD's own analysis pending). EPSS exploit probability: 0.3%, top 77% of all CVEs by exploit prediction. GitHub Security Advisory data not yet ingested — confidence will rise once GHSA publishes (typical lag: hours to days for open-source ecosystem CVEs; never for infrastructure-only CVEs).

Triggered by: NVD CVSS baseline
Sources: epss, secondary
Trending — 3 sources updated this week
6.5EG
EchelonGraph verdictMonitorLow exploitation likelihood right now — keep watching.
  • Lower severity and no public exploit yet
CISA-KEV: Not listedEPSS PROB: 0%CVSS: 6.5Exploit: None knownExposed: 0

No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js permits SQL injection when attacker-controlled Buffer parameters are escaped client-side under the big5, gbk, sjis, cp932, or gb18030 client character sets. PacketOutputStream.writeBufferEscape in lib/io/packet-output-stream.js escaped bytes without the charset-aware getMbRecognizer logic in lib/misc/charset-mb.js. The server SQL lexer runs my_ismbchar before escape processing, so an attacker-controlled lead byte can consume the inserted 0x5C backslash as a multibyte trail byte and leave the following 0x27 quote unescaped, terminating the string literal and allowing arbitrary SQL. The default utf8mb4 character set and parameters sent through the execute binary prepared-statement path are not affected. Successful exploitation can expose or modify data available to the database account. This issue is fixed in versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3.

CVSS v3
6.5
EG Score
6.5(medium)
EG Risk
34(Track)
EG Risk 34/100SSVC: Track

EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).

How it’s computed
Severity65% × 45%
Exploitation0% × 40%
Automatability30% × 15%
Action: Routine — remediate on your standard cadence.
EPSS PROB
0%
EPSS %ILE
23%
KEV
Not listed

Published

August 28, 2026

Last Modified

August 28, 2026

Advisory Details (10)

Auto-updated Aug 28, 2026
Patch available. Sources: github, github_commit, github_release.
generic

[CONJS-350] Possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets - Jira

https://jira.mariadb.org/browse/CONJS-350
github_release Patch Available

MariaDB Connector/Node.js 3.5.3

Patch available: mariadb-corporation/mariadb-connector-nodejs 3.5.3

https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.5.3
github_release Patch Available

MariaDB Connector/Node.js 3.4.6

Patch available: mariadb-corporation/mariadb-connector-nodejs 3.4.6

https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.4.6
github_release Patch Available

MariaDB Connector/Node.js 3.3.3

Patch available: mariadb-corporation/mariadb-connector-nodejs 3.3.3

https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.3.3
github_release Patch Available

MariaDB Connector/Node.js 3.2.4

Patch available: mariadb-corporation/mariadb-connector-nodejs 3.2.4

https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.2.4
github_commit Patch Available

commit 97f183f33b5d (mariadb-corporation/mariadb-connector-nodejs)

Patch available: mariadb-corporation/mariadb-connector-nodejs 3.3.3 (contains commit 97f183f33b5d)

https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/97f183f33b5d4e6767b34ecabdd81fe3294a80a6
github_commit Patch Available

commit 7af8b7b8b7ae (mariadb-corporation/mariadb-connector-nodejs)

Patch available: mariadb-corporation/mariadb-connector-nodejs 3.5.3 (contains commit 7af8b7b8b7ae)

https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/7af8b7b8b7ae5e1a081693ade989f5a80c8e06e3
github_commit Patch Available

commit 26e35f9edb00 (mariadb-corporation/mariadb-connector-nodejs)

Patch available: mariadb-corporation/mariadb-connector-nodejs 3.4.6 (contains commit 26e35f9edb00)

https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/26e35f9edb00bcf249627a564e0052fba7b305a2
github_commit Patch Available

commit 25c6239b68fd (mariadb-corporation/mariadb-connector-nodejs)

Patch available: mariadb-corporation/mariadb-connector-nodejs 3.2.4 (contains commit 25c6239b68fd)

https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/25c6239b68fd909132355c3f8535a5ef32423468
github Patch Available

Possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets · Advisory · mariadb-corporation/mariadb-connector-nodejs · GitHub

Affected: 3.2.4, 3.3.3, 3.4.6, and 3.5.3. Upgrade to the patched release on your branch:

https://github.com/mariadb-corporation/mariadb-connector-nodejs/security/advisories/GHSA-g5xc-5w98-jfvm

Vendor Advisories for CVE-2026-55855(1)

These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.

Weakness Classification(2)

MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.

Data Freshness Timeline

(refreshed 5× in last 7d / 5× in last 30d)

Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.

  1. 2026-08-30 01:34 UTCEG score recompute
  2. 2026-08-30 01:22 UTCEPSS rescore
  3. 2026-08-28 23:25 UTCEG score recompute
  4. 2026-08-28 22:22 UTCEG score recompute
  5. 2026-08-28 22:18 UTCMITRE cvelistV5first tracked

Related CVEs(same CWE)

Frequently asked(5)

What is CVE-2026-55855?
CVE-2026-55855 is a medium vulnerability published on August 28, 2026. MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js permits SQL injection when attacker-controlled Buffer parameters are escaped client-side under the big5, gbk, sjis,…
When was CVE-2026-55855 disclosed?
CVE-2026-55855 was first published in the National Vulnerability Database on August 28, 2026. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
Is CVE-2026-55855 actively exploited?
CVE-2026-55855 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 0% probability of exploitation in the next 30 days, which ranks it in the top 76.7% of all scored CVEs.
What is the CVSS score of CVE-2026-55855?
CVE-2026-55855 has a CVSS v3 base score of 6.5 (NVD).
How do I remediate CVE-2026-55855?
Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2026-55855, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.

Dependency Blast Radius

Explore the affected products and dependency analysis for CVE-2026-55855

Explore →

Is Your Infrastructure Affected by CVE-2026-55855?

EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.

Start Free Scan →Browse All CVEs