> For the complete documentation index, see [llms.txt](https://mariadb.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mariadb.com/docs/release-notes/connectors/node.js/3.x/3.4.7.md).

# Connector/Node.js 3.4.7 Release Notes

{% hint style="info" %}

<p align="center">The most recent release of <a href="/spaces/CjGYMsT2MVP4nd3IyW2L/pages/WmpaptiE3kKy2mNO6ps0">MariaDB Connector/Node.js</a> is: <a href="/pages/wwViqXFWujnwjjonCYzb"><strong>3.5.4</strong></a></p>

<p align="center"><a href="https://mariadb.com/downloads/connectors/connectors-data-access/nodejs-connector" class="button primary">Download Connector/Node.js 3.5.4</a></p>
{% endhint %}

<a href="https://mariadb.com/downloads/connectors/connectors-data-access/nodejs-connector" class="button primary">Download</a> <a href="/pages/C9Mw9HR2imyJUdcxAfsm" class="button secondary">Release Notes</a> <a href="/pages/N80XQAdYKpTbcKIRkp5t" class="button secondary">Changelog</a> <a href="/spaces/CjGYMsT2MVP4nd3IyW2L/pages/x5uWNz6Wb26ooKT9S74U" class="button secondary">Connector/Node.js Overview</a>

**Release date:** 7 Aug 2026

MariaDB Connector/Node.js 3.4.7 is a [***Stable***](/docs/release-notes/community-server/about/release-criteria.md) ***(GA)*** release.

{% hint style="success" %}
**For an overview of MariaDB Connector/Node.js see the** [**About MariaDB Connector/Node.js**](/docs/connectors/mariadb-connector-nodejs/mariadb-connector-node-js-guide.md) **page**
{% endhint %}

## Notable changes

* [CONJS-357](https://jira.mariadb.org/browse/CONJS-357) Add JavaScript SAST (CodeQL and `eslint-plugin-security`) to CI

## Bug Fixes

* [CONJS-358](https://jira.mariadb.org/browse/CONJS-358) Refuse multi-part packet (> 16 MB) reassembly before authentication completes, since a rogue server could otherwise exhaust client memory before any credential is validated
* [CONJS-363](https://jira.mariadb.org/browse/CONJS-363) `typeCast` accessors returned corrupted values with prepared statements
* [CONJS-367](https://jira.mariadb.org/browse/CONJS-367) Uninitialized process memory leaked to the server via a malformed GeoJSON Polygon parameter (report by fg0x0)
* [CONJS-368](https://jira.mariadb.org/browse/CONJS-368) Fixed SQL injection in the text protocol when the session uses `NO_BACKSLASH_ESCAPES` (report by fg0x0)
* [CONJS-369](https://jira.mariadb.org/browse/CONJS-369) Fixed SQL injection through object keys in `SET` expansion when using `permitSetMultiParamEntries` (report by fg0x0)
* Escape the server-supplied filename before building the `LOAD DATA LOCAL INFILE` validation regular expression

<sub>*This page is: Copyright © 2026 MariaDB. All rights reserved.*</sub>

{% @marketo/form formid="4316" formId="4316" %}