{"record":{"id":"dc4e7d63a27bb59b","repo":"sidorares/node-mysql2","slug":"unexpected-data-in-authmoredata-packet-received-by-dc4e7d","errorCode":null,"errorMessage":"Unexpected data in AuthMoreData packet received by ${PLUGIN_NAME} plugin in state ${state}","messagePattern":"Unexpected data in AuthMoreData packet received by (.+?) plugin in state (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"lib/auth_plugins/caching_sha2_password.js","lineNumber":105,"sourceCode":"\n            state = STATE_WAIT_SERVER_KEY;\n            return REQUEST_SERVER_KEY_PACKET;\n          }\n          throw new Error(\n            `Invalid AuthMoreData packet received by ${PLUGIN_NAME} plugin in STATE_TOKEN_SENT state.`\n          );\n        case STATE_WAIT_SERVER_KEY:\n          if (pluginOptions.onServerPublicKey) {\n            pluginOptions.onServerPublicKey(data);\n          }\n          return authWithKey(data);\n        case STATE_FINAL:\n          throw new Error(\n            `Unexpected data in AuthMoreData packet received by ${PLUGIN_NAME} plugin in STATE_FINAL state.`\n          );\n      }\n\n      throw new Error(\n        `Unexpected data in AuthMoreData packet received by ${PLUGIN_NAME} plugin in state ${state}`\n      );\n    };\n  };\n\n// Export the plugin factory as default\nmodule.exports = pluginFactory;\n\n// Export calculateToken for reuse in initial handshake optimization\nmodule.exports.calculateToken = calculateToken;\n","sourceCodeStart":87,"sourceCodeEnd":116,"githubUrl":"https://github.com/sidorares/node-mysql2/blob/8b1f829d3706404ab372cf97bd77ebcf86578d97/lib/auth_plugins/caching_sha2_password.js#L87-L116","documentation":"Defensive catch-all at the bottom of caching_sha2_password's state machine (lib/auth_plugins/caching_sha2_password.js:105-107). Every defined state (0, 1, 2, -1) is handled by a case above, so reaching this throw means the internal state variable took an unhandled value — an invariant violation inside the plugin. It should be effectively unreachable in normal operation.","triggerScenarios":"Corrupted in-memory state caused by a concurrent reuse of the plugin closure across two connections (the plugin factory returns a function holding closure-local state); a bug in a custom fork that mutates the plugin's state; memory corruption from native code.","commonSituations":"A user wraps and reuses the plugin factory output across connections instead of letting the driver instantiate it per connection; an incompatible mysql2 fork; extremely rare race in connection sharing.","solutions":["Ensure auth plugin factories are not shared or cached across connections — let the driver build a fresh plugin per connection.","Reproduce on the latest mysql2 release and file an issue with the full connection config and server version.","Remove any monkey-patching of connection._authPlugin or the plugin's internal state."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { await conn.connect(); } catch (e) { if (/Unexpected data in AuthMoreData.*state/.test(e.message)) { /* report upstream; do not retry on same socket */ conn.destroy(); } throw e; }","preventionTips":["Never cache or share a plugin factory's returned function across connections.","Reproduce on stock mysql2 latest before assuming application fault."],"tags":["authentication","caching-sha2-password","internal","defensive"],"backgroundTag":null,"analyzedSha":"8b1f829d3706404ab372cf97bd77ebcf86578d97","analyzedAt":"2026-08-11T02:54:28.964Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}