Connector/Node.js 3.5.4 Release Notes

Connector/Node.js 3.5.4 is a Stable (GA) release of MariaDB Connector/Node.js, released on 2026-08-07

Download Release Notes Changelog Connector/Node.js Overview

Release date: 7 Aug 2026

MariaDB Connector/Node.js 3.5.4 is a Stable (GA) release.

For an overview of MariaDB Connector/Node.js see the About MariaDB Connector/Node.js page

Notable changes

• CONJS-366 New maxAllowedColumns option (default 65535), bounding the column count a server may announce for a result-set or a prepared statement. Without it, a rogue server can make the client allocate metadata for a result-set that never completes.

• CONJS-355 Connection options are merged through the prototype chain instead of being flat-cloned for every command (#353, contribution by erulabs)

• CONJS-365 Enable standard TLS certificate identity validation under Deno

• CONJS-357 Add JavaScript SAST (CodeQL and eslint-plugin-security) to CI

Connection option changes

Two connection options changed since 3.5.3:

• maxAllowedColumns (new, integer, default 65535) — maximum number of columns a server-announced result-set or prepare metadata may declare. The column count is read from the wire before any metadata is allocated for it, so a malicious or man-in-the-middle server announcing an enormous count could otherwise exhaust client memory. A larger count closes the connection with a fatal error instead. The value must be an integer greater than 0.

• maxAllowedPacket (default changed) — when the option is not set, the default is now a quarter of the memory available to the process (the cgroup limit when containerized, physical memory otherwise), bounded to [16 MB, 1 GB]. It was previously a fixed 16 MB. The value is also advertised to the server in the handshake response and now bounds packet reassembly on the read side: a server announcing a larger packet is refused rather than growing the reassembly buffer. Set it to the server's real max_allowed_packet; a lower value rejects legitimate results.

Bug Fixes

• CONJS-329 An exception thrown by a callback was reported to that same callback as a database error, instead of propagating like it does from any other Node.js-style callback (report by Assen Totin)

• CONJS-356 Corrected ed25519 authentication with zero-configuration SSL

• CONJS-358 Refuse multi-part packet (> 16 MB) reassembly before authentication completes, since a rogue server could otherwise exhaust client memory before any credential is validated

• CONJS-359 Corrected the default maxAllowedPacket value when the option is not set

• CONJS-360 batch() ignored the insertIdAsNumber / supportBigNumbers / bigNumberStrings options for insertId

• CONJS-361 The connection stopped sending commands after a command ending on the last packet of a network chunk: a prepared statement was never executed, without error nor timeout (report by Assen Totin)

• CONJS-362 Limit the parsec authentication PBKDF2 iteration factor and move the key derivation off the event loop, since a rogue server could otherwise freeze the whole process for minutes (report by fg0x0)

• CONJS-363 typeCast accessors returned corrupted values with prepared statements

• CONJS-364 Types / TypeNumbers enums threw at runtime (#347, contribution by BrianDouglasIE)

• CONJS-367 Uninitialized process memory leaked to the server via a malformed GeoJSON Polygon parameter (report by fg0x0)

• CONJS-368 Fixed SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES (report by fg0x0)

• CONJS-369 Fixed SQL injection through object keys in SET expansion when using permitSetMultiParamEntries (report by fg0x0)

• SqlError lost its constructor shape in the 3.5 ESM migration, so err instanceof SqlError threw Right-hand side of 'instanceof' is not callable (#356, contribution by GiHoon1123)

• The type definitions declared StreamCallback as a value the module never exports. It is now a type alias, so code typing the stream option as typeof StreamCallback must use StreamCallback instead

_{This page is: Copyright © 2026 MariaDB. All rights reserved.}