---
id: GHSA-3f6p-5ww8-9rcr
title: >-
  MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext
  Credentials
summary: >-
  MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext
  Credentials
severity: high
cwe:
  - CWE-522
vendor: mysql2
product: mysql2
ecosystem: npm
affected:
  - mysql2 < 3.22.0
patched:
  - mysql2 3.22.0
published: '2026-09-01'
updated: '2026-09-01'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-3f6p-5ww8-9rcr'
references:
  - url: >-
      https://github.com/sidorares/node-mysql2/security/advisories/GHSA-3f6p-5ww8-9rcr
  - url: 'https://github.com/sidorares/node-mysql2/issues/1617'
  - url: 'https://github.com/sidorares/node-mysql2/pull/4236'
  - url: >-
      https://github.com/sidorares/node-mysql2/commit/884bec56288d827939d0dd3f1f4ae476fbc8dbeb
  - url: 'https://github.com/sidorares/node-mysql2/releases/tag/v3.22.0'
  - url: 'https://github.com/advisories/GHSA-3f6p-5ww8-9rcr'
tags:
  - ghsa
  - npm
ingestedAt: '2026-09-01T17:29:54.697Z'
---

## Overview

## Summary

A rogue MySQL server (or MITM) can force mysql2 to send credentials in **plaintext** by requesting an auth switch to `mysql_clear_password`. The driver complies without verifying that TLS is active.

## Details

`mysql_clear_password` is registered as a default standard plugin in `lib/commands/auth_switch.js` (line 21). When a server sends an AuthSwitchRequest (0xFE) requesting `mysql_clear_password`, the driver executes it without checking for TLS. The plugin (`lib/auth_plugins/mysql_clear_password.js`) returns `Buffer.from(password + '\0')`.

Note: `caching_sha2_password` plugin DOES check for SSL before sending cleartext (line 77). But `mysql_clear_password` has no such guard.

## Attack Scenario

1. Attacker operates rogue MySQL server or performs MITM
2. Server advertises `caching_sha2_password` in handshake
3. Client sends hashed auth response
4. Server replies with AuthSwitchRequest to `mysql_clear_password`
5. Client sends password in plaintext
6. Attacker captures plaintext password

## PoC

Rogue MySQL server (Node.js, ~80 lines) that captures plaintext passwords from mysql2 clients. Tested against mysql2 3.20.0. Full PoC available on request.

## Suggested Fix

Remove `mysql_clear_password` from `standardAuthPlugins`, or add a guard requiring TLS/unix socket before allowing cleartext auth.

## Impact

- mysql2: 9M weekly downloads
- Any application connecting without TLS is vulnerable to credential theft
- Cloud environments with untrusted network paths are especially at risk

## Affected packages

- `mysql2 < 3.22.0`

## Remediation

Upgrade to a patched release:

- `mysql2 3.22.0`