{"id":"8fd4db3605280c88","repo":"sidorares/node-mysql2","slug":"unexpected-data-in-authmoredata-packet-received-by-8fd4db","errorCode":null,"errorMessage":"Unexpected data in AuthMoreData packet received by sha256_password plugin in STATE_FINAL state.","messagePattern":"Unexpected data in AuthMoreData packet received by sha256_password plugin in STATE_FINAL state\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"lib/auth_plugins/sha256_password.js","lineNumber":65,"sourceCode":"            return Buffer.from(`${password}\\0`, 'utf8');\n          }\n\n          scramble = data.slice(0, 20);\n          // if client provides key we can save one extra roundrip on first connection\n          if (pluginOptions.serverPublicKey) {\n            return authWithKey(pluginOptions.serverPublicKey);\n          }\n\n          state = STATE_WAIT_SERVER_KEY;\n          return REQUEST_SERVER_KEY_PACKET;\n\n        case STATE_WAIT_SERVER_KEY:\n          if (pluginOptions.onServerPublicKey) {\n            pluginOptions.onServerPublicKey(data);\n          }\n          return authWithKey(data);\n        case STATE_FINAL:\n          throw new Error(\n            `Unexpected data in AuthMoreData packet received by ${PLUGIN_NAME} plugin in STATE_FINAL state.`\n          );\n      }\n\n      throw new Error(\n        `Unexpected data in AuthMoreData packet received by ${PLUGIN_NAME} plugin in state ${state}`\n      );\n    };\n  };\n","sourceCodeStart":47,"sourceCodeEnd":75,"githubUrl":"https://github.com/sidorares/node-mysql2/blob/5ebe8903d6aea2d8ea1490e11b52491526e50f19/lib/auth_plugins/sha256_password.js#L47-L75","documentation":"The sha256_password plugin reached STATE_FINAL (the password was already sent, encrypted with the server's RSA public key), yet the server sent another AuthMoreData packet. Like the caching_sha2_password equivalent, the plugin has no further auth step to perform, so extra data signals a client/server protocol desync.","triggerScenarios":"Connecting to a MySQL server configured with the sha256_password plugin (less common than caching_sha2_password) where the server emits a spurious AuthMoreData after the client already delivered the RSA-encrypted password. Seen with proxies that replay auth packets or with buggy server builds.","commonSituations":"A MySQL user account explicitly set to sha256_password; a proxy or connection-pooler interfering with the auth sequence; an older MySQL 5.7 server with known auth-edge bugs; connecting through middleware that does not understand the sha256_password flow.","solutions":["Connect directly to mysqld (bypassing any proxy) to isolate the source.","Enable TLS/SSL on the connection so the password is sent in cleartext over the secure channel and the multi-step RSA exchange is avoided.","Update the proxy/middleware or disable its auth-packet inspection/replay.","Upgrade MySQL server and mysql2 to current releases.","If possible, switch the account to caching_sha2_password or mysql_native_password."],"exampleFix":"// before\nconst conn = mysql.createConnection({ host, user, password }); // account uses sha256_password\n\n// after — TLS lets sha256_password skip the RSA round-trips\nconst conn = mysql.createConnection({\n  host,\n  user,\n  password,\n  ssl: { rejectUnauthorized: true },\n});","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  const conn = await mysql.createConnection({ ...cfg, ssl: { rejectUnauthorized: true } });\n} catch (err) {\n  if (/Unexpected data in AuthMoreData.*sha256_password.*STATE_FINAL/.test(err.message)) {\n    // bypass proxy or switch account plugin\n  } else throw err;\n}","preventionTips":["Enable TLS so sha256_password avoids the multi-step RSA exchange.","Bypass intermediaries when isolating auth failures.","Keep server and driver current."],"tags":["auth","sha256-password","protocol","connection"],"analyzedSha":"5ebe8903d6aea2d8ea1490e11b52491526e50f19","analyzedAt":"2026-08-03T18:58:53.602Z","schemaVersion":2}