GHSA-rgwj-5xj2-c3m3: MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS

August 31, 2026 (updated September 2, 2026)

Denial of Service of the client application (process crash / OOM) — not the database itself. No authentication bypass or data exposure. Requires compress: true plus a malicious/compromised server or MITM position.

References

github.com/advisories/GHSA-rgwj-5xj2-c3m3
github.com/sidorares/node-mysql2/commit/7c48343c95ecc80d30d6ebfa67875947b7d848d2
github.com/sidorares/node-mysql2/releases/tag/v3.23.1
github.com/sidorares/node-mysql2/security/advisories/GHSA-rgwj-5xj2-c3m3

Code Behaviors & Features

Detect and mitigate GHSA-rgwj-5xj2-c3m3 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →