How severe is GHSA-3f6p-5ww8-9rcr?

No CVSS score has been assigned to GHSA-3f6p-5ww8-9rcr yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by GHSA-3f6p-5ww8-9rcr?

GHSA-3f6p-5ww8-9rcr affects the following packages: mysql2 (npm). Ecosystems affected: npm.

How do I fix GHSA-3f6p-5ww8-9rcr?

Update mysql2 to 3.22.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-3f6p-5ww8-9rcr is resolved across your whole dependency graph.

How do I detect GHSA-3f6p-5ww8-9rcr in my npm dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for mysql2. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.

How do I mitigate GHSA-3f6p-5ww8-9rcr if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

How does O3 Security protect against GHSA-3f6p-5ww8-9rcr?

O3 pinpoints whether GHSA-3f6p-5ww8-9rcr is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Is GHSA-3f6p-5ww8-9rcr actively exploited in the wild?

No public exploit code has been indexed for GHSA-3f6p-5ww8-9rcr yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-3f6p-5ww8-9rcr published, and has it been updated?

GHSA-3f6p-5ww8-9rcr was published on September 1, 2026 and was last updated on September 1, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

📦 npm

Not in CISA KEV

GHSA-3f6p-5ww8-9rcr

Fix: sidorares/node-mysql2#4236

GHSA-3f6p-5ww8-9rcr is a security vulnerability in mysql2. O3 Security confirms whether GHSA-3f6p-5ww8-9rcr is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.

MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials

Published

Sep 1, 2026

Updated

Sep 1, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Sep 1, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

7Kother npm packages depend on this — each one inherits the vulnerability until it's patched upstream

mysql2npm

15.2Mdownloads / week

Description

Summary

A rogue MySQL server (or MITM) can force mysql2 to send credentials in plaintext by requesting an auth switch to mysql_clear_password. The driver complies without verifying that TLS is active.

Details

mysql_clear_password is registered as a default standard plugin in lib/commands/auth_switch.js (line 21). When a server sends an AuthSwitchRequest (0xFE) requesting mysql_clear_password, the driver executes it without checking for TLS. The plugin (lib/auth_plugins/mysql_clear_password.js) returns Buffer.from(password + '\0').

Note: caching_sha2_password plugin DOES check for SSL before sending cleartext (line 77). But mysql_clear_password has no such guard.

Attack Scenario

Attacker operates rogue MySQL server or performs MITM
Server advertises caching_sha2_password in handshake
Client sends hashed auth response
Server replies with AuthSwitchRequest to mysql_clear_password
Client sends password in plaintext
Attacker captures plaintext password

PoC

Rogue MySQL server (Node.js, ~80 lines) that captures plaintext passwords from mysql2 clients. Tested against mysql2 3.20.0. Full PoC available on request.

Suggested Fix

Remove mysql_clear_password from standardAuthPlugins, or add a guard requiring TLS/unix socket before allowing cleartext auth.

Impact

mysql2: 9M weekly downloads
Any application connecting without TLS is vulnerable to credential theft
Cloud environments with untrusted network paths are especially at risk

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
📦npm	`mysql2`	all versions	3.22.0

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for mysql2. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update mysql2 to 3.22.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-3f6p-5ww8-9rcr is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-3f6p-5ww8-9rcr is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Tailored to GHSA-3f6p-5ww8-9rcr. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

## Summary A rogue MySQL server (or MITM) can force mysql2 to send credentials in **plaintext** by requesting an auth switch to `mysql_clear_password`. The driver complies without verifying that TLS is active. ## Details `mysql_clear_password` is registered as a default standard plugin in `lib/commands/auth_switch.js` (line 21). When a server sends an AuthSwitchRequest (0xFE) requesting `mysql_clear_password`, the driver executes it without checking for TLS. The plugin (`lib/auth_plugins/mysql_clear_password.js`) returns `Buffer.from(password + '\0')`. Note: `caching_sha2_password` plugin

O3 Security · Impact-Aware SCA

Is GHSA-3f6p-5ww8-9rcr in your dependencies?

O3 detects GHSA-3f6p-5ww8-9rcr across npm dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

Scan my dependencies How O3 SCA works