> For the complete documentation index, see [llms.txt](https://mariadb.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mariadb.com/docs/release-notes/connectors/node.js/3.x/3.5.5.md).

# Connector/Node.js 3.5.5 Release Notes

Connector/Node.js 3.5.5 is a Stable (GA) release of MariaDB Connector/Node.js, released on 2026-11-05

<a href="https://mariadb.com/downloads/connectors/connectors-data-access/nodejs-connector" class="button primary">Download</a> <a href="/docs/release-notes/connectors/node.js/3.x/3.5.5.md" class="button secondary">Release Notes</a> <a href="/docs/release-notes/connectors/node.js/changelogs/3.x/3.5.5.md" class="button secondary">Changelog</a> <a href="/docs/connectors/mariadb-connector-nodejs/mariadb-connector-node-js-guide.md" class="button secondary">Connector/Node.js Overview</a>

**Release date:** 5 Nov 2026

MariaDB Connector/Node.js 3.5.5 is a [***Stable***](/docs/release-notes/community-server/about/release-criteria.md) ***(GA)*** release.

{% hint style="success" %}
**For an overview of MariaDB Connector/Node.js see the** [**About MariaDB Connector/Node.js**](/docs/connectors/mariadb-connector-nodejs/mariadb-connector-node-js-guide.md) **page**
{% endhint %}

## Notable changes

* [CONJS-373](https://jira.mariadb.org/browse/CONJS-373) Each release ships a signed CycloneDX 1.6 software bill of materials (SBOM) listing the package's dependencies, for supply-chain audits
* [CONJS-377](https://jira.mariadb.org/browse/CONJS-377) Faster queries: client-side parsing of the query and decoding of `DATE`, `DATETIME`, and ASCII values in text protocol results take less time
* [CONJS-382](https://jira.mariadb.org/browse/CONJS-382) Faster text protocol queries with large string parameters: a string with nothing to escape is encoded natively, 3x faster at 128 characters and 10x or more from 512 characters
* [CONJS-383](https://jira.mariadb.org/browse/CONJS-383) Faster `execute()` on large result sets: binary protocol rows no longer allocate a buffer per row, 40% faster on a 1000-row result set

## Bug Fixes

* A pool that fails to create a connection now reports the failure through the [`logger`](/docs/connectors/mariadb-connector-nodejs/node-js-connection-options.md) option when the application registers no `error` listener; earlier versions installed a default listener that silently dropped the failure (#180)
* [CONJS-371](https://jira.mariadb.org/browse/CONJS-371) `changeUser()` failed with `ER_SELF_SIGNED_SHA256` for a `caching_sha2_password` user after a self-signed TLS handshake, although the connection was already authenticated (report by fg0x0)
* [CONJS-378](https://jira.mariadb.org/browse/CONJS-378) `pool.escape()` returned a backslash-escaped value under `NO_BACKSLASH_ESCAPES` when every connection of the pool was in use, leaving the value injectable (report by buxuwa)
* [CONJS-379](https://jira.mariadb.org/browse/CONJS-379) SQL injection through a `Buffer` parameter under the big5 client charset: the five lead bytes 0xFA-0xFE, single bytes for the server, were not escaped (report by fg0x0)
* [CONJS-380](https://jira.mariadb.org/browse/CONJS-380) SQL injection through a string parameter or `escape()` under the big5, gbk, sjis, and cp932 client charsets, ordinary characters encoding to sequences the server reads as single bytes (report by fg0x0)
* [CONJS-381](https://jira.mariadb.org/browse/CONJS-381) A connection configured with a charset the server does not support, such as gb18030 on MariaDB, silently stayed on utf8mb4 while parameters were escaped for the requested charset; a configured collation is now always set with `SET NAMES`, so the server refuses the connection (report by fg0x0)
* [CONJS-385](https://jira.mariadb.org/browse/CONJS-385) Type definitions: TypeScript users can now pass `bitOneIsBoolean`, `jsonStrings`, `fullResult`, `restrictedAuth`, `permitConnectionWhenExpired`, `permitRedirect`, `charsetNumber`, `enableKeepAlive`, `keepAliveInitialDelay`, a function or `logParam` for `logger`, without a cast; the unused `logPackets` option and the internal `ConnectionInfo.collation` are no longer declared; the pool's `error` and `enqueue` events and `SqlError.cause` are declared
* [CONJS-386](https://jira.mariadb.org/browse/CONJS-386) A query issued while the connection was still sending a previous command, such as a large insert or a streamed parameter, could be silently dropped and its promise never settled, including when the connection failed (#358, contribution by GiHoon1123)
* [CONJS-388](https://jira.mariadb.org/browse/CONJS-388) The `meta` property of a result could not be deleted, which made every Sequelize raw query fail with `Cannot delete property 'meta'` (#234)
* [CONJS-389](https://jira.mariadb.org/browse/CONJS-389) `connection.destroy()` did not kill the running query on a TLS connection with certificate validation: the kill connection, opened on the server IP address, failed hostname verification; the query promise also never settled when that kill connection could not be opened (#304)

<sub>*This page is: Copyright © 2026 MariaDB. All rights reserved.*</sub>

{% @marketo/form formid="4316" formId="4316" %}