{"id":"2086d8288c344728","repo":"sidorares/node-mysql2","slug":"unexpected-data-in-authmoredata-packet-received-by-2086d8","errorCode":null,"errorMessage":"Unexpected data in AuthMoreData packet received by caching_sha2_password plugin in state ${state}","messagePattern":"Unexpected data in AuthMoreData packet received by caching_sha2_password plugin in state (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"lib/auth_plugins/caching_sha2_password.js","lineNumber":105,"sourceCode":"\n            state = STATE_WAIT_SERVER_KEY;\n            return REQUEST_SERVER_KEY_PACKET;\n          }\n          throw new Error(\n            `Invalid AuthMoreData packet received by ${PLUGIN_NAME} plugin in STATE_TOKEN_SENT state.`\n          );\n        case STATE_WAIT_SERVER_KEY:\n          if (pluginOptions.onServerPublicKey) {\n            pluginOptions.onServerPublicKey(data);\n          }\n          return authWithKey(data);\n        case STATE_FINAL:\n          throw new Error(\n            `Unexpected data in AuthMoreData packet received by ${PLUGIN_NAME} plugin in STATE_FINAL state.`\n          );\n      }\n\n      throw new Error(\n        `Unexpected data in AuthMoreData packet received by ${PLUGIN_NAME} plugin in state ${state}`\n      );\n    };\n  };\n\n// Export the plugin factory as default\nmodule.exports = pluginFactory;\n\n// Export calculateToken for reuse in initial handshake optimization\nmodule.exports.calculateToken = calculateToken;\n","sourceCodeStart":87,"sourceCodeEnd":116,"githubUrl":"https://github.com/sidorares/node-mysql2/blob/5ebe8903d6aea2d8ea1490e11b52491526e50f19/lib/auth_plugins/caching_sha2_password.js#L87-L116","documentation":"A defensive fallthrough inside the caching_sha2_password plugin's state machine: the AuthMoreData handler was invoked while `state` held a value that matches no case in the switch (i.e. not INITIAL, TOKEN_SENT, WAIT_SERVER_KEY, or FINAL). Under normal operation `state` is always one of those constants, so reaching this throw indicates an internal logic error or memory/state corruption rather than an expected network condition.","triggerScenarios":"Reached only if the plugin's internal `state` variable is mutated to an unexpected value — for example by a bug in a forked/patched mysql2, a concurrent re-use of the plugin instance across two handshakes, or memory corruption. In stock mysql2 this branch is effectively unreachable.","commonSituations":"A custom auth plugin or a patched mysql2 that mismanages the `state` variable; reusing a single plugin closure across multiple simultaneous connection handshakes (the closure is per-connection by design); an extremely corrupted packet stream that somehow skipped the recognised states.","solutions":["Ensure you are using official, unmodified mysql2 and upgrade to the latest version.","Do not share or reuse auth plugin instances across connections — let mysql2 instantiate them per connection.","If you wrote a custom authPlugins entry wrapping caching_sha2_password, verify it does not mutate internal state.","Open an issue with mysql2 including the MySQL server version, mysql2 version, and a minimal reproducer."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  await mysql.createConnection(cfg);\n} catch (err) {\n  if (/caching_sha2_password plugin in state/.test(err.message)) {\n    // report a bug — this branch should be unreachable in stock mysql2\n  } else throw err;\n}","preventionTips":["Do not reuse auth plugin closures across connections.","Use unmodified mysql2.","Report with a minimal reproducer if you hit it."],"tags":["auth","caching-sha2-password","protocol","internal"],"analyzedSha":"5ebe8903d6aea2d8ea1490e11b52491526e50f19","analyzedAt":"2026-08-03T18:58:53.602Z","schemaVersion":2}