CVE-2026-107383

{
  "etk_id": "ETK-2026-1039",
  "cve_id": "CVE-2026-107383",
  "display_id": "CVE-2026-107383",
  "ghsa_id": "GHSA-48qf-xh34-q73r",
  "euvd_id": "EUVD-2026-95142",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Uninitialized memory disclosure in mariadb GeoJSON encoding",
  "summary": "Affected npm mariadb releases can disclose uninitialized Node.js process memory when attacker-influenced GeoJSON Polygon or MultiPolygon values are supplied through execute() or batch(). An attacker must be able to provide malformed geometry data that the application passes as a bound parameter; exposed data may be retained in database records and downstream copies.",
  "mitigation": "Upgrade npm mariadb to 3.2.5, 3.3.4, 3.4.7, or 3.5.4, as appropriate for the release line. Until upgraded, validate GeoJSON coordinate structures before binding them, or use query() for these operations.",
  "vendor": "npm",
  "product": "npm:mariadb",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<3.2.5"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "3.2.5"
      ],
      "package_name": "mariadb",
      "purl": "pkg:npm/mariadb"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 3.3.0, < 3.3.4"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "3.3.4"
      ],
      "package_name": "mariadb",
      "purl": "pkg:npm/mariadb"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 3.4.0, < 3.4.7"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "3.4.7"
      ],
      "package_name": "mariadb",
      "purl": "pkg:npm/mariadb"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 3.5.0-rc.0, < 3.5.4"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "3.5.4"
      ],
      "package_name": "mariadb",
      "purl": "pkg:npm/mariadb"
    }
  ],
  "cwes": [
    200
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss_score": 0.0039,
  "epss_percentile": 0.3148,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 11.892376516666667,
  "t0_at": "2026-10-08T18:27:02.543000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-09T04:32:48.923617+00:00",
      "days": 0.42067570158564815,
      "is_lower_bound": false,
      "measured_at": "2026-10-08T18:27:02.543000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-08T18:27:02.543000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-08T18:27:02.543000+00:00",
      "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/security/advisories/GHSA-48qf-xh34-q73r"
    }
  }
}