sidorares/node-mysql2 · error · Error

Unexpected data in AuthMoreData packet received by ${PLUGIN_

Error message

Unexpected data in AuthMoreData packet received by ${PLUGIN_NAME} plugin in state ${state}

What it means

Defensive catch-all at the bottom of sha256_password's switch (lib/auth_plugins/sha256_password.js:70-72). All defined states (STATE_INITIAL=0, STATE_WAIT_SERVER_KEY=1, STATE_FINAL=-1) have explicit cases, so reaching this throw implies the state variable was corrupted — an internal invariant violation, not a user-config issue.

Source

Thrown at lib/auth_plugins/sha256_password.js:70

          if (pluginOptions.serverPublicKey) {
            return authWithKey(pluginOptions.serverPublicKey);
          }

          state = STATE_WAIT_SERVER_KEY;
          return REQUEST_SERVER_KEY_PACKET;

        case STATE_WAIT_SERVER_KEY:
          if (pluginOptions.onServerPublicKey) {
            pluginOptions.onServerPublicKey(data);
          }
          return authWithKey(data);
        case STATE_FINAL:
          throw new Error(
            `Unexpected data in AuthMoreData packet received by ${PLUGIN_NAME} plugin in STATE_FINAL state.`
          );
      }

      throw new Error(
        `Unexpected data in AuthMoreData packet received by ${PLUGIN_NAME} plugin in state ${state}`
      );
    };
  };

View on GitHub (pinned to 8b1f829d37)

Solutions

Do not reuse a plugin instance across connections; let the driver instantiate per-connection.
Reproduce on stock mysql2 latest and file an issue with server version and config.

Defensive patterns

Strategy: try-catch

Try / catch

try { await conn.connect(); } catch (e) { if (/sha256_password.*state/.test(e.message)) { conn.destroy(); } throw e; }

Prevention

Do not reuse plugin instances across connections.
File an upstream issue with server version if hit on stock mysql2.

When it happens

Trigger: Plugin closure shared across connections causing state bleed; a forked/patched plugin that mutates state incorrectly; memory corruption.

Common situations: Custom code caching the plugin factory result and reusing it; rarely, a genuine bug worth reporting upstream.

Related errors

AI-assisted analysis of sidorares/node-mysql2@8b1f829d37 (2026-08-11). Data as JSON: /api/errors/88d8efb9a554cdc6. Report an issue: GitHub.