mysql2

3.24.6 · 13 Oct 2026MIT9.6M / weekRepository Homepage npm Atom feed

Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

Paste your package.json, or type the range you declare for mysql2. It is read in your browser and sent nowhere.

Line	Newest	Where it stands
	3.24.6	Safe from 3.23.1
	2.3.3	126 open advisories, worst critical · last release Nov 2021, no longer updated

Your version

Critical
MySQL2 for Node Arbitrary Code InjectionGHSA-4rch-2fh8-94vw · 23 Apr 2024
- 3.x3.0.0 – 3.9.6Fixed in 3.9.7
- 2.x and older0.0.1 – 2.3.3No fix, no longer updated · move to 3.9.7
Critical
mysql2 Remote Code Execution (RCE) via the readCodeFor functionGHSA-fpw7-j2hg-69v5 · 11 Apr 2024
- 3.x3.0.0 – 3.9.3Fixed in 3.9.4
- 2.x and older0.0.1 – 2.3.3No fix, no longer updated · move to 3.9.4
High
MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext CredentialsGHSA-3f6p-5ww8-9rcr · 1 Sep 2026
- 3.x3.0.0 – 3.21.1Fixed in 3.22.0
- 2.x and older0.0.1 – 2.3.3No fix, no longer updated · move to 3.22.0
High
mysql2 vulnerable to Prototype PollutionGHSA-pmh2-wpjm-fj45 · 30 May 2024
- 3.x3.0.0 – 3.9.7Fixed in 3.9.8
- 2.x and older0.0.1 – 2.3.3No fix, no longer updated · move to 3.9.8
Moderate
MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoSGHSA-rgwj-5xj2-c3m3 · 31 Aug 2026
- 3.x3.0.0 – 3.23.0Fixed in 3.23.1
- 2.x and older0.0.1 – 2.3.3No fix, no longer updated · move to 3.23.1
Moderate
mysql2 cache poisoning vulnerabilityGHSA-mqr2-w7wj-jjgr · 10 Apr 2024
- 3.x3.0.0 – 3.9.2Fixed in 3.9.3
- 2.x and older0.0.1 – 2.3.3No fix, no longer updated · move to 3.9.3
Moderate
mysql2 vulnerable to Prototype PoisoningGHSA-49j4-86m8-q2jw · 10 Apr 2024
- 3.x3.0.0 – 3.9.3Fixed in 3.9.4
- 2.x and older0.0.1 – 2.3.3No fix, no longer updated · move to 3.9.4

What npm and deps.dev say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 21 Oct 2026. Releases and advisories last read 21 Oct 2026.