CVE-2024-21512

What it actually does

mysql2 versions before 3.9.8 can perform unsafe object key assignment when the nestTables feature is enabled. If attacker-controlled table names, column names, or aliases are processed into nested result objects, special JavaScript property names such as __proto__, constructor, or prototype may modify object prototypes instead of ordinary result fields. This is prototype pollution: application-wide objects may inherit attacker-controlled properties, which can corrupt application logic, alter authorization or validation decisions, trigger unsafe code paths, or cause runtime instability. The flaw primarily affects integrity and can also cause limited availability impact through crashes or malformed object behavior.

Why it matters to the business

Applications using vulnerable mysql2 versions may be exposed to remote manipulation of application behavior if untrusted input can influence SQL identifiers, result aliases, dynamic queries, or interaction with an untrusted database endpoint while nestTables is enabled. Business impact can include incorrect transaction handling, bypassed business rules, corrupted API responses, service instability, and increased incident response effort. This issue has a high CVSS score but currently has low EPSS probability, no known CISA KEV listing, no ransomware association, and no reported mature public exploitation in the provided data; however, it has been public for a long time, so remediation should be prioritized in internet-facing or multi-tenant Node.js services that use mysql2 with nestTables.

How an attack unfolds

An attacker first needs a path to influence the names returned in a mysql2 query result while nestTables is enabled. Common paths include SQL injection, application functionality that accepts user-controlled field or table aliases, unsafe query-builder usage, dynamically selected report columns, or use of an untrusted or compromised MySQL-compatible server. The attacker crafts a query or database response that causes mysql2 to process a field or table name such as __proto__, constructor, or prototype. In vulnerable versions, mysql2 places the result into a nested JavaScript object without adequately blocking prototype-related keys. The malicious key assignment can pollute Object.prototype or related prototype chains. After pollution, later application code that trusts inherited object properties may make incorrect decisions, skip validation, change default options, or fail unexpectedly. Successful impact depends heavily on how the affected application consumes query results after the polluted object is created.

How to fix it

Upgrade mysql2 to version 3.9.8 or later. If consuming sidorares/node-mysql2 directly from Git, pin to commit efe3db527a2c94a63c2d14045baba8dfefe922bc or a later trusted commit/tag. Regenerate and redeploy lockfiles so transitive and bundled instances are updated across all services. If immediate upgrade is not possible, disable nestTables where feasible, avoid passing untrusted input into table names, column names, aliases, or identifier construction, strictly allowlist dynamic identifiers, use parameterized queries for values, and reject prototype-related keys such as __proto__, prototype, and constructor in any user-controlled identifier-like input. Treat mitigations as temporary because application-level filtering may miss non-obvious query paths.

How to confirm the fix worked

Confirm that deployed applications no longer contain mysql2 versions earlier than 3.9.8. Use package inventory commands such as npm ls mysql2, pnpm why mysql2, yarn why mysql2, or software composition analysis tooling, and verify package-lock.json, yarn.lock, pnpm-lock.yaml, container images, and built artifacts. For Git dependencies, confirm the resolved commit is efe3db527a2c94a63c2d14045baba8dfefe922bc or later. Review code for nestTables usage and dynamic SQL identifier construction. Add regression tests that execute nestTables queries with aliases such as __proto__, constructor, and prototype and verify that Object.prototype is not modified and that returned rows treat those names safely or reject them.

Typical attack path

1. Identify a Node.js application using mysql2 before 3.9.8.
2. Determine whether the application enables mysql2 nestTables for query result handling.
3. Find a way to influence SQL table names, column names, aliases, or database metadata returned to the application, such as through SQL injection, dynamic reporting features, unsafe identifier interpolation, or a malicious database endpoint.
4. Send input that causes a result field or nested table key to be named __proto__, constructor, prototype, or a related prototype-pollution payload.
5. Trigger the vulnerable query path so mysql2 constructs nested result objects using the attacker-controlled key.
6. Leverage polluted object properties in subsequent application logic to alter behavior, corrupt data handling, bypass checks, or cause runtime errors.

How to detect it

To assess prior exploitation, review application, database, and web access logs for evidence that untrusted users supplied SQL aliases, column selectors, report fields, sort fields, or table names containing prototype-pollution terms. Relevant log sources include application request logs, API gateway/WAF logs, database general query logs, ORM/query-builder debug logs, MySQL audit logs, Node.js process logs, crash logs, and error monitoring traces. Look for SQL statements using aliases or identifiers named __proto__, prototype, constructor, constructor.prototype, or nested variants. Also investigate sudden Node.js TypeError exceptions, unexpected inherited properties in serialized objects, authorization or validation anomalies, and repeated requests to reporting/search/export endpoints that build dynamic SQL. Because this vulnerability does not create a unique file, process, or network artifact by itself, detection should focus on suspicious SQL identifier payloads and downstream application behavior shortly after those requests.

• __proto__
• constructor.prototype
• prototype pollution
• AS `__proto__`
• AS '__proto__'
• AS "__proto__"
• AS __proto__
• AS `constructor`
• AS "constructor"
• AS `prototype`
• AS "prototype"
• nestTables
• node_modules/mysql2/package.json
• mysql2@3.9.7
• mysql2@3.9.6
• mysql2@3.9.5
• mysql2@3.9.4
• mysql2@3.9.3
• mysql2@3.9.2
• mysql2@3.9.1
• mysql2@3.9.0

What your security team should do

• Prioritize upgrading all direct and transitive mysql2 dependencies to 3.9.8 or later, especially in internet-facing Node.js applications and services that use nestTables.
• Search code repositories for nestTables usage and dynamic SQL identifier construction; require allowlists for table, column, and alias names.
• Review SQL injection findings and dynamic reporting/query-builder features because they can provide the control needed to exploit this issue.
• Add dependency scanning gates to CI/CD to block mysql2 versions before 3.9.8.
• Enable or review database query logging for suspicious aliases or identifiers containing __proto__, constructor, or prototype.
• After patching, restart Node.js processes because prototype pollution effects may persist in memory until process restart.
• If suspicious exploitation is found, rotate affected application instances, review authorization and transaction logs for anomalous behavior, and perform targeted application integrity checks.