Medium
Security advisory
Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through parserFn in text_parser.js and binary_parser.js.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2024-21509
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 5 Nov 2026, 02:05 UTC · Revision 1
Source evidence
Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through parserFn in text_parser.js and binary_parser.js.
osv:CVE-2024-21509
Complete source record
{
"id": "abb4b774be31e9b5d1532971a4ca12275c5dfd584a901d62fbc93374181fe86e",
"url": "https://osv.dev/vulnerability/CVE-2024-21509",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2024-21509",
"summary": "Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through parserFn in text_parser.js and binary_parser.js.",
"evidence": "osv:CVE-2024-21509",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2024-21509",
"aliases": [
"CVE-2024-21509",
"GHSA-49j4-86m8-q2jw"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/sidorares/node-mysql2",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "cf3fa60842e7e359db5b1d676f93a22ad6fea082"
},
{
"fixed": "4a964a3910a4b8de008696c554ab1b492e9b4691"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:sidorares:mysql2:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "3.9.4"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "4a964a3910a4b8de008696c554ab1b492e9b4691"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "cf3fa60842e7e359db5b1d676f93a22ad6fea082"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v3.9.4"
}
]
}
}
],
"versions": [
"v3.9.3",
"v3.9.2",
"v3.9.1",
"v3.9.0",
"v3.8.0",
"v3.7.1",
"v3.7.0",
"v3.6.5",
"v3.6.4",
"v3.6.3",
"v3.6.2",
"v3.6.1",
"v3.6.0",
"v3.5.2",
"v3.5.1",
"v3.5.0",
"v3.4.5",
"v3.4.4",
"v3.4.3",
"v3.4.2",
"v3.4.1",
"v3.4.0",
"v3.3.5",
"v3.3.4",
"v3.3.3",
"v3.3.2",
"v3.3.1",
"v3.3.0",
"v3.2.4",
"v3.2.3",
"v3.2.2",
"v3.2.1",
"v3.2.0",
"v3.1.2",
"v3.1.1",
"v3.1.0",
"v3.0.1",
"v3.0.0",
"v3.0.0-rc.1",
"v2.3.3",
"v2.3.3-rc.0",
"v2.3.2",
"v2.3.1",
"v2.3.0",
"v2.2.5",
"v2.2.4",
"v2.2.3",
"v2.2.2",
"v2.2.1",
"v2.2.0",
"v2.1.0",
"v1.6.5",
"v2.0.2",
"v2.0.1",
"v2.0.0",
"v2.0.0-alpha1",
"v1.6.4",
"v1.6.3",
"v1.6.2",
"v1.5.3",
"v1.5.2",
"v1.5.1",
"v1.5.0",
"v1.4.2",
"v1.4.1",
"v1.3.6",
"v1.3.5",
"v1.3.4",
"v1.3.3",
"v1.3.2",
"v1.3.1",
"v1.3.0",
"v1.2.0",
"v1.1.2",
"v1.1.1",
"v1.1.0",
"v1.0.0",
"v1.0.0-rc.12",
"v1.0.0-rc.11",
"v1.0.0-rc.10",
"v1.0.0-rc.9",
"v1.0.0-rc.8",
"v1.0.0-rc.7",
"v1.0.0-rc.6",
"v1.0.0-rc.5",
"v1.0.0-rc.4",
"v1.0.0-rc.3",
"v1.0.0-rc.2",
"v0.15.8",
"v0.15.7",
"v0.15.6",
"v0.15.5",
"v0.15.4",
"v0.15.3",
"v0.15.2",
"v0.15.1",
"v0.15.0",
"v0.14.1",
"v0.14.0",
"v0.13.0",
"v0.12.5",
"v0.12.4",
"v0.12.3",
"v0.12.2",
"v0.12.1",
"v0.12.0",
"v0.11.7",
"v0.11.6",
"v0.11.5",
"v0.9.2",
"v0.8.20",
"v0.8.19",
"v0.8.18",
"v0.8.17",
"v0.8.16",
"v0.8.15",
"v0.8.14",
"v0.8.13",
"v0.8.11"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-21509.json"
}
}
],
"modified": "2026-10-28T02:30:41.863943629Z",
"provider": "osv",
"references": [
"https://github.com/sidorares/node-mysql2/blob/fd3d117da82cc5c5fa5a3701d7b33ca77691bc61/lib/parsers/text_parser.js%23L134",
"https://github.com/sidorares/node-mysql2/releases/tag/v3.9.4",
"https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6591084",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21509.json",
"https://nvd.nist.gov/vuln/detail/CVE-2024-21509",
"https://github.com/sidorares/node-mysql2/commit/4a964a3910a4b8de008696c554ab1b492e9b4691",
"https://github.com/sidorares/node-mysql2/pull/2574",
"https://blog.slonser.info/posts/mysql2-attacker-configuration/"
],
"provider_metadata": {
"cwe_ids": [
"CWE-1321"
],
"cna_assigner": "snyk",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21509.json"
}
},
"related_cves": [
{
"value": "CVE-2024-21509",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 509352,
"published_at": "2024-04-10T05:00:00.795+00:00"
}