> For the complete documentation index, see [llms.txt](https://mariadb.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mariadb.com/docs/release-notes/connectors/node.js/3.x/3.5.4.md).

# Connector/Node.js 3.5.4 Release Notes

<a href="https://mariadb.com/downloads/connectors/connectors-data-access/nodejs-connector" class="button primary">Download</a> <a href="/pages/wwViqXFWujnwjjonCYzb" class="button secondary">Release Notes</a> <a href="/pages/VVXdFT4H7kKASCkG4TtC" class="button secondary">Changelog</a> <a href="/spaces/CjGYMsT2MVP4nd3IyW2L/pages/x5uWNz6Wb26ooKT9S74U" class="button secondary">Connector/Node.js Overview</a>

**Release date:** 7 Aug 2026

MariaDB Connector/Node.js 3.5.4 is a [***Stable***](/docs/release-notes/community-server/about/release-criteria.md) ***(GA)*** release.

{% hint style="success" %}
**For an overview of MariaDB Connector/Node.js see the** [**About MariaDB Connector/Node.js**](/docs/connectors/mariadb-connector-nodejs/mariadb-connector-node-js-guide.md) **page**
{% endhint %}

## Notable changes

* [CONJS-366](https://jira.mariadb.org/browse/CONJS-366) New [`maxAllowedColumns`](/docs/connectors/mariadb-connector-nodejs/node-js-connection-options.md) option (default `65535`), bounding the column count a server may announce for a result-set or a prepared statement. Without it, a rogue server can make the client allocate metadata for a result-set that never completes.
* [CONJS-355](https://jira.mariadb.org/browse/CONJS-355) Connection options are merged through the prototype chain instead of being flat-cloned for every command (#353, contribution by erulabs)
* [CONJS-365](https://jira.mariadb.org/browse/CONJS-365) Enable standard TLS certificate identity validation under Deno
* [CONJS-357](https://jira.mariadb.org/browse/CONJS-357) Add JavaScript SAST (CodeQL and `eslint-plugin-security`) to CI

### Connection option changes

Two [connection options](/docs/connectors/mariadb-connector-nodejs/node-js-connection-options.md) changed since 3.5.3:

* **`maxAllowedColumns`** (new, *integer*, default `65535`) — maximum number of columns a server-announced result-set or prepare metadata may declare. The column count is read from the wire before any metadata is allocated for it, so a malicious or man-in-the-middle server announcing an enormous count could otherwise exhaust client memory. A larger count closes the connection with a fatal error instead. The value must be an integer greater than 0.
* **`maxAllowedPacket`** (default changed) — when the option is not set, the default is now a quarter of the memory available to the process (the cgroup limit when containerized, physical memory otherwise), bounded to \[16 MB, 1 GB]. It was previously a fixed 16 MB. The value is also advertised to the server in the handshake response and now bounds packet reassembly on the read side: a server announcing a larger packet is refused rather than growing the reassembly buffer. Set it to the server's real [`max_allowed_packet`](/docs/server/server-management/variables-and-modes/server-system-variables.md#max_allowed_packet); a lower value rejects legitimate results.

## Bug Fixes

* [CONJS-329](https://jira.mariadb.org/browse/CONJS-329) An exception thrown by a callback was reported to that same callback as a database error, instead of propagating like it does from any other Node.js-style callback (report by Assen Totin)
* [CONJS-356](https://jira.mariadb.org/browse/CONJS-356) Corrected ed25519 authentication with zero-configuration SSL
* [CONJS-358](https://jira.mariadb.org/browse/CONJS-358) Refuse multi-part packet (> 16 MB) reassembly before authentication completes, since a rogue server could otherwise exhaust client memory before any credential is validated
* [CONJS-359](https://jira.mariadb.org/browse/CONJS-359) Corrected the default `maxAllowedPacket` value when the option is not set
* [CONJS-360](https://jira.mariadb.org/browse/CONJS-360) `batch()` ignored the `insertIdAsNumber` / `supportBigNumbers` / `bigNumberStrings` options for `insertId`
* [CONJS-361](https://jira.mariadb.org/browse/CONJS-361) The connection stopped sending commands after a command ending on the last packet of a network chunk: a prepared statement was never executed, without error nor timeout (report by Assen Totin)
* [CONJS-362](https://jira.mariadb.org/browse/CONJS-362) Limit the parsec authentication PBKDF2 iteration factor and move the key derivation off the event loop, since a rogue server could otherwise freeze the whole process for minutes (report by fg0x0)
* [CONJS-363](https://jira.mariadb.org/browse/CONJS-363) `typeCast` accessors returned corrupted values with prepared statements
* [CONJS-364](https://jira.mariadb.org/browse/CONJS-364) `Types` / `TypeNumbers` enums threw at runtime (#347, contribution by BrianDouglasIE)
* [CONJS-367](https://jira.mariadb.org/browse/CONJS-367) Uninitialized process memory leaked to the server via a malformed GeoJSON Polygon parameter (report by fg0x0)
* [CONJS-368](https://jira.mariadb.org/browse/CONJS-368) Fixed SQL injection in the text protocol when the session uses `NO_BACKSLASH_ESCAPES` (report by fg0x0)
* [CONJS-369](https://jira.mariadb.org/browse/CONJS-369) Fixed SQL injection through object keys in `SET` expansion when using `permitSetMultiParamEntries` (report by fg0x0)
* `SqlError` lost its constructor shape in the 3.5 ESM migration, so `err instanceof SqlError` threw `Right-hand side of 'instanceof' is not callable` (#356, contribution by GiHoon1123)
* The type definitions declared `StreamCallback` as a value the module never exports. It is now a type alias, so code typing the `stream` option as `typeof StreamCallback` must use `StreamCallback` instead

<sub>*This page is: Copyright © 2026 MariaDB. All rights reserved.*</sub>

{% @marketo/form formid="4316" formId="4316" %}