Connector/Node.js 3.5.3 Release Notes

Connector/Node.js 3.5.3 is a Stable (GA) release of MariaDB Connector/Node.js, released on 2026-06-09

The most recent release of MariaDB Connector/Node.js is: 3.5.4

Download Connector/Node.js 3.5.4

Download Release Notes Changelog Connector/Node.js Overview

Release date: 9 Jun 2026

MariaDB Connector/Node.js 3.5.3 is a Stable (GA) release.

For an overview of MariaDB Connector/Node.js see the About MariaDB Connector/Node.js page

Notable changes

• Minimum supported Node.js version is now 20 (was 18; Node 18 went EOL in April 2025)

• Expose extended column metadata in FieldInfo and add RowsWithMeta / WithMeta result-shape helper types for query result metadata

Bugs Fixed

• CONJS-344 Restore dual ESM/CJS support after the 3.5 ESM migration (#346):

  • TypeScript types now compile under moduleResolution: "Node16" / "NodeNext" / "Bundler". fixes TS2846 / TS2834 reported in 3.5.1 and 3.5.2

  • Ship a real CJS bundle in dist/ so require('mariadb') works on Node 20+ without --experimental-require-module or ExperimentalWarning

  • Restore the default ESM export, so import mariadb from 'mariadb' works again (matches 3.4.x behavior)

• CONJS-349 Fix cleartext password disclosure to a man-in-the-middle when using fingerprint validation

• CONJS-350 Possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets

• CONJS-351 Use constant-time comparison when validating the server certificate fingerprint, preventing a timing side-channel that could leak the token to a man-in-the-middle

• CONJS-353 PAM (dialog) authentication now requires a secure connection (TLS or a local unix socket), since it transmits the password in clear text

• CONJS-354 Reject a server-initiated LOAD DATA LOCAL INFILE request when permitLocalInfile is disabled

_{This page is: Copyright © 2026 MariaDB. All rights reserved.}