sidorares/node-mysql2 · error · Error

Unexpected data in AuthMoreData packet received by sha256_pa

Error message

Unexpected data in AuthMoreData packet received by sha256_password plugin in state ${state}

What it means

A defensive fallthrough in the sha256_password plugin: AuthMoreData arrived while `state` matched no switch case (neither INITIAL, WAIT_SERVER_KEY, nor FINAL). In stock mysql2 the state machine only takes recognised values, so hitting this branch means the internal state was corrupted or the plugin closure was misused across connections/handshakes.

Source

Thrown at lib/auth_plugins/sha256_password.js:70

          if (pluginOptions.serverPublicKey) {
            return authWithKey(pluginOptions.serverPublicKey);
          }

          state = STATE_WAIT_SERVER_KEY;
          return REQUEST_SERVER_KEY_PACKET;

        case STATE_WAIT_SERVER_KEY:
          if (pluginOptions.onServerPublicKey) {
            pluginOptions.onServerPublicKey(data);
          }
          return authWithKey(data);
        case STATE_FINAL:
          throw new Error(
            `Unexpected data in AuthMoreData packet received by ${PLUGIN_NAME} plugin in STATE_FINAL state.`
          );
      }

      throw new Error(
        `Unexpected data in AuthMoreData packet received by ${PLUGIN_NAME} plugin in state ${state}`
      );
    };
  };

View on GitHub (pinned to 5ebe8903d6)

Solutions

  1. Use the official mysql2 release and upgrade.
  2. Never share auth plugin instances across connections; mysql2 creates them per connection.
  3. Review any custom authPlugins configuration that wraps sha256_password.
  4. File an issue with mysql2 with version details and a reproducer.
Defensive patterns

Strategy: try-catch

Try / catch

try {
  await mysql.createConnection(cfg);
} catch (err) {
  if (/sha256_password plugin in state/.test(err.message)) {
    // effectively unreachable — report upstream
  } else throw err;
}

Prevention

When it happens

Trigger: Only reachable if the plugin's `state` variable holds an unrecognised value — e.g. a custom fork mutating state, reusing a plugin closure across connections, or memory corruption. Effectively unreachable in unmodified mysql2.

Common situations: A patched or forked mysql2 that altered the sha256_password state machine; sharing an auth plugin instance across multiple connections; an environment causing memory corruption.

Related errors

AI-assisted analysis of sidorares/node-mysql2@5ebe8903d6 (2026-08-03). Data as JSON: /data/errors/4cd093972b1da536.json. Report an issue: GitHub.