---
title: "MariaDB Node.js Connector 3.5.4 and 3.4.7 now available"
publish_date: 2026-08-07
author: "Daniel Bartholomew"
tags:
  - name: "Connector releases"
    url: "/resources/blog/tag/connector-releases.md"
  - name: "Connector/Node.js"
    url: "/resources/blog/tag/connector-node-js.md"
---

# MariaDB Node.js Connector 3.5.4 and 3.4.7 now available

MariaDB is pleased to announce the immediate availability of the MariaDB Connector/Node.js 3.5.4, 3.4.7, 3.3.4, and 3.2.5 GA releases.

**[Download Now](https://mariadb.com/downloads/connectors/connectors-data-access/nodejs-connector/)**

## Release Notes

### MariaDB Connector/Node.js 3.5.4

- [Release Notes for MariaDB Connector/Node.js 3.5.3](https://mariadb.com/docs/release-notes/connectors/node.js/3.x/3.5.4)

MariaDB Connector/Node.js 3.5.4 is a Stable (GA) release.

Notable changes in this release include:

- New maxAllowedColumns option (default 65535), bounding the column count a server may announce for a result-set or a prepared statement. Without it, a rogue server can make the client allocate metadata for a result-set that never completes.
- Connection options are merged through the prototype chain instead of being flat-cloned for every command (#353, contribution by erulabs)
- Enable standard TLS certificate identity validation under Deno
- Add JavaScript SAST (CodeQL and eslint-plugin-security) to CI
- Fixes for various issues

Two [connection options](https://mariadb.com/docs/connectors/mariadb-connector-nodejs/node-js-connection-options) changed since 3.5.3:

- `<strong>maxAllowedColumns</strong>` (new, *integer*, default `65535`) — maximum number of columns a server-announced result-set or prepare metadata may declare. The column count is read from the wire before any metadata is allocated for it, so a malicious or man-in-the-middle server announcing an enormous count could otherwise exhaust client memory. A larger count closes the connection with a fatal error instead. The value must be an integer greater than 0.
- `<strong>maxAllowedPacket</strong>` (default changed) — when the option is not set, the default is now a quarter of the memory available to the process (the cgroup limit when containerized, physical memory otherwise), bounded to \[16 MB, 1 GB\]. It was previously a fixed 16 MB. The value is also advertised to the server in the handshake response and now bounds packet reassembly on the read side: a server announcing a larger packet is refused rather than growing the reassembly buffer. Set it to the server’s real [`max_allowed_packet`](https://mariadb.com/docs/server/server-management/variables-and-modes/server-system-variables#max_allowed_packet); a lower value rejects legitimate results.

### MariaDB Connector/Node.js 3.4.7

- [Release Notes for MariaDB Connector/Node.js 3.4.7](https://mariadb.com/docs/release-notes/connectors/node.js/3.x/3.4.7)

MariaDB Connector/Node.js 3.4.7 is a Stable (GA) release.

Notable changes in this release include:

- Add JavaScript SAST (CodeQL and eslint-plugin-security) to CI
- Fixes for various issues

See the release notes page for more details and visit [mariadb.com/downloads/connectors/connectors-data-access/nodejs-connector/](https://mariadb.com/downloads/connectors/connectors-data-access/nodejs-connector/) to download.