{"id":"6265c5490d6852af","repo":"sidorares/node-mysql2","slug":"invalid-authmoredata-packet-received-by-caching-sh","errorCode":null,"errorMessage":"Invalid AuthMoreData packet received by caching_sha2_password plugin in STATE_TOKEN_SENT state.","messagePattern":"Invalid AuthMoreData packet received by caching_sha2_password plugin in STATE_TOKEN_SENT state\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"lib/auth_plugins/caching_sha2_password.js","lineNumber":91,"sourceCode":"          if (PERFORM_FULL_AUTHENTICATION_PACKET.equals(data)) {\n            const isSecureConnection =\n              typeof pluginOptions.overrideIsSecure === 'undefined'\n                ? connection.config.ssl || connection.config.socketPath\n                : pluginOptions.overrideIsSecure;\n            if (isSecureConnection) {\n              state = STATE_FINAL;\n              return Buffer.from(`${password}\\0`, 'utf8');\n            }\n\n            // if client provides key we can save one extra roundrip on first connection\n            if (pluginOptions.serverPublicKey) {\n              return authWithKey(pluginOptions.serverPublicKey);\n            }\n\n            state = STATE_WAIT_SERVER_KEY;\n            return REQUEST_SERVER_KEY_PACKET;\n          }\n          throw new Error(\n            `Invalid AuthMoreData packet received by ${PLUGIN_NAME} plugin in STATE_TOKEN_SENT state.`\n          );\n        case STATE_WAIT_SERVER_KEY:\n          if (pluginOptions.onServerPublicKey) {\n            pluginOptions.onServerPublicKey(data);\n          }\n          return authWithKey(data);\n        case STATE_FINAL:\n          throw new Error(\n            `Unexpected data in AuthMoreData packet received by ${PLUGIN_NAME} plugin in STATE_FINAL state.`\n          );\n      }\n\n      throw new Error(\n        `Unexpected data in AuthMoreData packet received by ${PLUGIN_NAME} plugin in state ${state}`\n      );\n    };\n  };","sourceCodeStart":73,"sourceCodeEnd":109,"githubUrl":"https://github.com/sidorares/node-mysql2/blob/5ebe8903d6aea2d8ea1490e11b52491526e50f19/lib/auth_plugins/caching_sha2_password.js#L73-L109","documentation":"During caching_sha2_password authentication, after the client sends its scramble-based token (STATE_TOKEN_SENT), the server is expected to reply with either a fast-auth-success byte (0x03) or a perform-full-authentication byte (0x04). If the AuthMoreData packet contains any other leading byte, the plugin cannot interpret the server's intent and throws this error. This is a MySQL wire-protocol contract violation — the server sent something the plugin does not recognise for this handshake phase.","triggerScenarios":"Connecting to a MySQL 8+ server that uses caching_sha2_password (the 8.0+ default) where the server's AuthMoreData reply starts with a byte that is neither 0x03 nor 0x04 during the second leg of the handshake. Typically caused by a truncated/corrupted packet on the TCP stream, an incompatible or buggy server/proxy, or a man-in-the-middle altering the auth exchange.","commonSituations":"A buggy or non-conformant MySQL-compatible proxy (e.g. an older ProxySQL, a custom proxy, or a load balancer doing L7 inspection) rewriting auth packets; a flaky network dropping bytes; connecting to a server whose authentication plugin behaviour diverges from upstream MySQL (some forks/older MariaDB builds); TCP packet corruption from MTU/MSS mismatch.","solutions":["Enable SSL/TLS on the connection (set ssl options) so the auth exchange is encrypted and less susceptible to middleware tampering, and so caching_sha2_password can use the secure-connection fast path.","Verify the MySQL server version and that it genuinely supports caching_sha2_password; if it is a proxy or fork, test a direct connection to the real mysqld to isolate the intermediary.","Upgrade mysql2 to the latest release, as protocol-handling fixes land frequently.","If you control the server, set the user's plugin to mysql_native_password as a workaround (ALTER USER ... IDENTIFIED WITH mysql_native_password).","Inspect network/MTU settings and proxy configuration for packet corruption or rewriting."],"exampleFix":"// before\nconst conn = mysql.createConnection({ host, user, password });\n\n// after (force TLS so the auth handshake is protected)\nconst conn = mysql.createConnection({\n  host,\n  user,\n  password,\n  ssl: { rejectUnauthorized: true },\n});","handlingStrategy":"try-catch","validationCode":"// No caller-side validation can predict a malformed server packet.\n// Validate reachability/compatibility instead:\nfunction preflightAuth(host, port) {\n  // ensure server is reachable and is a real MySQL 8+ before relying on caching_sha2_password\n  return checkPortOpen(host, port) && checkServerVersion(host, port);\n}","typeGuard":null,"tryCatchPattern":"try {\n  const conn = await mysql.createConnection({ host, user, password, ssl: { rejectUnauthorized: true } });\n} catch (err) {\n  if (/Invalid AuthMoreData packet.*caching_sha2_password/.test(err.message)) {\n    // log and retry with mysql_native_password account or via a different route\n  } else throw err;\n}","preventionTips":["Always enable SSL for caching_sha2_password connections.","Test against the real mysqld, not just a proxy, when debugging auth.","Keep mysql2 and the MySQL server on current patch releases."],"tags":["auth","caching-sha2-password","protocol","connection","network"],"analyzedSha":"5ebe8903d6aea2d8ea1490e11b52491526e50f19","analyzedAt":"2026-08-03T18:58:53.602Z","schemaVersion":2}