CVE-2024-21508: RCE in mysql2 Node.js Package

Successful exploitation of CVE-2024-21508 allows an attacker to execute arbitrary code on the system hosting the Node.js application utilizing the vulnerable mysql2 package. This could lead to complete system compromise, including data exfiltration, malware installation, and denial of service. The impact is particularly severe because mysql2 is a widely used package for interacting with MySQL databases in Node.js applications, meaning a large number of applications could be at risk. The ability to execute arbitrary code bypasses standard security controls and grants the attacker significant control over the affected system. This vulnerability shares similarities with other RCE flaws where improper input validation allows for code injection, potentially leading to similar attack vectors.

1. Reserved2023-12-22
2. Published2024-04-11
3. Modified2026-02-04
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-21508 is to immediately upgrade the mysql2 package to version 3.9.4 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing temporary workarounds. While not a complete solution, input validation on the supportBigNumbers and bigNumberStrings parameters before passing them to the readCodeFor function can reduce the attack surface. Monitor Node.js application logs for unusual activity or errors related to the mysql2 package. Consider using a Web Application Firewall (WAF) to filter potentially malicious requests targeting the vulnerable function, although this is not a substitute for patching.