sidorares/node-mysql2 · error · Error

Unexpected data in AuthMoreData packet received by caching_s

Error message

Unexpected data in AuthMoreData packet received by caching_sha2_password plugin in state ${state}

What it means

A defensive fallthrough inside the caching_sha2_password plugin's state machine: the AuthMoreData handler was invoked while `state` held a value that matches no case in the switch (i.e. not INITIAL, TOKEN_SENT, WAIT_SERVER_KEY, or FINAL). Under normal operation `state` is always one of those constants, so reaching this throw indicates an internal logic error or memory/state corruption rather than an expected network condition.

Source

Thrown at lib/auth_plugins/caching_sha2_password.js:105

            state = STATE_WAIT_SERVER_KEY;
            return REQUEST_SERVER_KEY_PACKET;
          }
          throw new Error(
            `Invalid AuthMoreData packet received by ${PLUGIN_NAME} plugin in STATE_TOKEN_SENT state.`
          );
        case STATE_WAIT_SERVER_KEY:
          if (pluginOptions.onServerPublicKey) {
            pluginOptions.onServerPublicKey(data);
          }
          return authWithKey(data);
        case STATE_FINAL:
          throw new Error(
            `Unexpected data in AuthMoreData packet received by ${PLUGIN_NAME} plugin in STATE_FINAL state.`
          );
      }

      throw new Error(
        `Unexpected data in AuthMoreData packet received by ${PLUGIN_NAME} plugin in state ${state}`
      );
    };
  };

// Export the plugin factory as default
module.exports = pluginFactory;

// Export calculateToken for reuse in initial handshake optimization
module.exports.calculateToken = calculateToken;

View on GitHub (pinned to 5ebe8903d6)

Solutions

Ensure you are using official, unmodified mysql2 and upgrade to the latest version.
Do not share or reuse auth plugin instances across connections — let mysql2 instantiate them per connection.
If you wrote a custom authPlugins entry wrapping caching_sha2_password, verify it does not mutate internal state.
Open an issue with mysql2 including the MySQL server version, mysql2 version, and a minimal reproducer.

Defensive patterns

Strategy: try-catch

Try / catch

try {
  await mysql.createConnection(cfg);
} catch (err) {
  if (/caching_sha2_password plugin in state/.test(err.message)) {
    // report a bug — this branch should be unreachable in stock mysql2
  } else throw err;
}

Prevention

Do not reuse auth plugin closures across connections.
Use unmodified mysql2.
Report with a minimal reproducer if you hit it.

When it happens

Trigger: Reached only if the plugin's internal `state` variable is mutated to an unexpected value — for example by a bug in a forked/patched mysql2, a concurrent re-use of the plugin instance across two handshakes, or memory corruption. In stock mysql2 this branch is effectively unreachable.

Common situations: A custom auth plugin or a patched mysql2 that mismanages the `state` variable; reusing a single plugin closure across multiple simultaneous connection handshakes (the closure is per-connection by design); an extremely corrupted packet stream that somehow skipped the recognised states.

Related errors

AI-assisted analysis of sidorares/node-mysql2@5ebe8903d6 (2026-08-03). Data as JSON: /data/errors/2086d8288c344728.json. Report an issue: GitHub.