{"id":"4cd093972b1da536","repo":"sidorares/node-mysql2","slug":"unexpected-data-in-authmoredata-packet-received-by-4cd093","errorCode":null,"errorMessage":"Unexpected data in AuthMoreData packet received by sha256_password plugin in state ${state}","messagePattern":"Unexpected data in AuthMoreData packet received by sha256_password plugin in state (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"lib/auth_plugins/sha256_password.js","lineNumber":70,"sourceCode":"          if (pluginOptions.serverPublicKey) {\n            return authWithKey(pluginOptions.serverPublicKey);\n          }\n\n          state = STATE_WAIT_SERVER_KEY;\n          return REQUEST_SERVER_KEY_PACKET;\n\n        case STATE_WAIT_SERVER_KEY:\n          if (pluginOptions.onServerPublicKey) {\n            pluginOptions.onServerPublicKey(data);\n          }\n          return authWithKey(data);\n        case STATE_FINAL:\n          throw new Error(\n            `Unexpected data in AuthMoreData packet received by ${PLUGIN_NAME} plugin in STATE_FINAL state.`\n          );\n      }\n\n      throw new Error(\n        `Unexpected data in AuthMoreData packet received by ${PLUGIN_NAME} plugin in state ${state}`\n      );\n    };\n  };\n","sourceCodeStart":52,"sourceCodeEnd":75,"githubUrl":"https://github.com/sidorares/node-mysql2/blob/5ebe8903d6aea2d8ea1490e11b52491526e50f19/lib/auth_plugins/sha256_password.js#L52-L75","documentation":"A defensive fallthrough in the sha256_password plugin: AuthMoreData arrived while `state` matched no switch case (neither INITIAL, WAIT_SERVER_KEY, nor FINAL). In stock mysql2 the state machine only takes recognised values, so hitting this branch means the internal state was corrupted or the plugin closure was misused across connections/handshakes.","triggerScenarios":"Only reachable if the plugin's `state` variable holds an unrecognised value — e.g. a custom fork mutating state, reusing a plugin closure across connections, or memory corruption. Effectively unreachable in unmodified mysql2.","commonSituations":"A patched or forked mysql2 that altered the sha256_password state machine; sharing an auth plugin instance across multiple connections; an environment causing memory corruption.","solutions":["Use the official mysql2 release and upgrade.","Never share auth plugin instances across connections; mysql2 creates them per connection.","Review any custom authPlugins configuration that wraps sha256_password.","File an issue with mysql2 with version details and a reproducer."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  await mysql.createConnection(cfg);\n} catch (err) {\n  if (/sha256_password plugin in state/.test(err.message)) {\n    // effectively unreachable — report upstream\n  } else throw err;\n}","preventionTips":["Never share auth plugin instances across connections.","Use official mysql2."],"tags":["auth","sha256-password","protocol","internal"],"analyzedSha":"5ebe8903d6aea2d8ea1490e11b52491526e50f19","analyzedAt":"2026-08-03T18:58:53.602Z","schemaVersion":2}