Update Fix

node_modules/mysql2/lib/commands/auth_switch.js

@@ -11,12 +11,31 @@ const caching_sha2_password = require('../auth_plugins/caching_sha2_password.js'
 const mysql_native_password = require('../auth_plugins/mysql_native_password.js');
 const mysql_clear_password = require('../auth_plugins/mysql_clear_password.js');
 
-const standardAuthPlugins = {
+// Use Object.create(null) to avoid prototype pollution
+// This prevents server-controlled pluginName values like "toString" or "__proto__"
+// from resolving to prototype properties
+const standardAuthPlugins = Object.assign(Object.create(null), {
   sha256_password: sha256_password({}),
   caching_sha2_password: caching_sha2_password({}),
   mysql_native_password: mysql_native_password({}),
   mysql_clear_password: mysql_clear_password({}),
-};
+});
+
+// Helper function to get auth plugin (custom or standard)
+function getAuthPlugin(pluginName, connection) {
+  const customPlugins = connection.config.authPlugins;
+
+  // Check custom plugins with hasOwnProperty for safety
+  if (
+    customPlugins &&
+    Object.prototype.hasOwnProperty.call(customPlugins, pluginName)
+  ) {
+    return customPlugins[pluginName];
+  }
+
+  // Safe to access standardAuthPlugins directly since it has no prototype
+  return standardAuthPlugins[pluginName];
+}
 
 function warnLegacyAuthSwitch() {
   console.warn(
@@ -35,8 +54,6 @@ function authSwitchPluginError(error, command) {
 function authSwitchRequest(packet, connection, command) {
   const { pluginName, pluginData } =
     Packets.AuthSwitchRequest.fromPacket(packet);
-  let authPlugin =
-    connection.config.authPlugins && connection.config.authPlugins[pluginName];
 
   // legacy plugin api don't allow to override mysql_native_password
   // if pluginName is mysql_native_password it's using standard auth4.1 auth
@@ -54,9 +71,8 @@ function authSwitchRequest(packet, connection, command) {
     });
     return;
   }
-  if (!authPlugin) {
-    authPlugin = standardAuthPlugins[pluginName];
-  }
+
+  const authPlugin = getAuthPlugin(pluginName, connection);
   if (!authPlugin) {
     throw new Error(
       `Server requests authentication using unknown plugin ${pluginName}. See ${'TODO: add plugins doco here'} on how to configure or author authentication plugins.`
@@ -108,4 +124,6 @@ function authSwitchRequestMoreData(packet, connection, command) {
 module.exports = {
   authSwitchRequest,
   authSwitchRequestMoreData,
+  getAuthPlugin,
+  standardAuthPlugins,
 };