# MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters

MariaDB Node.js connector sized GeoJSON Polygon buffers from a non-array ring's length but never wrote them, leaking uninitialized heap into the database.

- Payout: Research
- Severity: high
- Program: MariaDB Connector/Node.js
- Found by: fg0x0
- Disclosed: 2026-10-08
- CVE: CVE-2026-107383
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-48qf-xh34-q73r
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-48qf-xh34-q73r
- Tags: area:oss domain:oss impact:data-leak impact:internal-access kind:research platform:ghsa sev:high tech:nodejs technique:source-review vuln:info-disclosure vuln:memory-corruption

**Target:** npm mariadb connector binary-protocol GeoJSON parameter encoder
**Root cause:** Polygon/MultiPolygon encoder reserved 4 + 16 * ring.length bytes for any ring with a numeric length, but only wrote rings that were real arrays; Buffer.allocUnsafe() output was returned in full regardless of write position, exposing uninitialized heap.
**Steps:**
1. Pass an object shaped like `{"type": "Polygon", "coordinates": [{"length": 4000}]}` as a parameter to `execute()` or `batch()`.
2. Encoder reserves 4 + 16 * 4000 bytes from `Buffer.allocUnsafe()` for the non-array ring.
3. Writing loop skips the ring because it is not an array, leaving the reserved bytes uninitialized.
4. Full buffer is sent to the server and stored in the column, containing prior heap contents.
**How found:** Reporter compared the Polygon/MultiPolygon encoder against the sibling LineString path, which aborts with null on the first malformed point; the two loops (sizing vs writing) disagreed on non-array rings with numeric length.
**Exploitation:** Attacker-influenced GeoJSON parameter (e.g. map/location feature) is passed to execute()/batch(); the insert succeeds silently and the row holds uninitialized process heap readable by anyone who can read that row, persisting into backups and replicas.
**Escalation:** Shared Node.js process heap may contain other users' request/response bodies, session tokens, cookies, DB credentials and TLS key material, so the leak crosses user boundaries.
**Insight:** When a serializer sizes a buffer in one loop and fills it in another, feed each loop a different notion of validity (non-array object with numeric `length`) and check whether allocUnsafe output is truncated to the write offset; sibling code paths that abort early reveal the missing guard.