mysql2

fast mysql driver. Implements core protocol, prepared statements, ssl and compression in native JS

Latest 3.24.5

NPM

88%

Total Score

healthy

Healthy: frequent releases and an active, maintained repository outweigh workflow hygiene concerns.

Are you affected? Scan for Free

Health Score Breakdown

Project backing

The repository is owned by an individual rather than an organization, so the single registry maintainer provides less formal handoff capacity; active repository contributors partly compensate.

Workflow audit

All 13 workflows were analyzed with no untrusted checkout or script-injection findings, but all 60 action references are unpinned and three workflows inject the entire secrets context, creating notable hygiene concerns.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-765062 mysql2 is vulnerable to Insufficiently Protected Credentials in versions 3.0.0 - 3.21.1.	3.0.0 - 3.21.1	High
AIKIDO-2026-448685 mysql2 is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 3.23.0.	0.0.1 - 3.23.0	Medium
AIKIDO-2026-10225 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. mysql2 is vulnerable to SQL Injection in versions 0.0.1 - 3.16.3.	0.0.1 - 3.16.3	High
CVE-2024-21512 mysql2 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in versions 0.0.0 - 3.9.8.	0.0.0 - 3.9.8	High
AIKIDO-2024-10037 mysql2 is vulnerable to Remote Code Execution (RCE) in versions 2.0.0 - 3.9.6.	2.0.0 - 3.9.6	Critical

Package versions

Maintainers

sidorares

Direct Dependencies

Dependency	Last Release	Score
long Version ^5.3.2	—	—
lru.min Version ^1.1.4	—	—
iconv-lite Version ^0.7.3	—	—
sql-escaper Version ^1.5.1	—	—
aws-ssl-profiles Version ^1.1.2	—	—