The mysql npm package, a popular choice for connecting Node.js applications to MySQL databases, saw a minor version update from 2.1.0 to 2.1.1 in March 2014. Both versions share the same core features: providing a JavaScript-based, MIT-licensed driver that requires no compilation, making it exceptionally easy to integrate into Node.js projects. This simplicity is a major draw for developers seeking a straightforward database interaction solution.
The dependency structure remained consistent between the two versions, relying on require-all, bignumber.js, and readable-stream for internal functionality. Similarly, the development dependencies, including utest, urun, and underscore, used for testing and tooling, were unchanged. This suggests the update was focused on bug fixes or minor enhancements rather than introducing substantial new functionality or altering fundamental dependencies.
Developers already using version 2.1.0 would find the upgrade to 2.1.1 safe, as no breaking changes are indicated by unchanged version for the dependencies. Since the differences are minimal, upgrading to 2.1.1 provides the benefit of the latest bug fixes and refinements, ensuring a more stable and reliable experience when interacting with MySQL databases. The package's well-established repository ensures its continued maintenance and relevance within the Node.js ecosystem. Always check the changelog (not available here) for specific details about fixes.
All the vulnerabilities related to the version 2.1.1 of the package
mysql Node.JS Module Vulnerable to Remote Memory Exposure
Versions of mysql before 2.14.0 are vulnerable to remove memory exposure.
Affected versions of mysql package allocate and send an uninitialized memory over the network when a number is provided as a password.
Only mysql running on Node.js versions below 6.0.0 are affected due to a throw added in newer node.js versions.
Proof of Concept:
require('mysql').createConnection({
host: 'localhost',
user: 'user',
password : USERPROVIDEDINPUT, // number
database : 'my_db'
}).connect();
Update to version 2.14.0 or later.