sidorares/node-mysql2 · error · Error

Unexpected data in AuthMoreData packet received by ${PLUGIN_

Error message

Unexpected data in AuthMoreData packet received by ${PLUGIN_NAME} plugin in state ${state}

What it means

Defensive catch-all at the bottom of caching_sha2_password's state machine (lib/auth_plugins/caching_sha2_password.js:105-107). Every defined state (0, 1, 2, -1) is handled by a case above, so reaching this throw means the internal state variable took an unhandled value — an invariant violation inside the plugin. It should be effectively unreachable in normal operation.

Source

Thrown at lib/auth_plugins/caching_sha2_password.js:105

            state = STATE_WAIT_SERVER_KEY;
            return REQUEST_SERVER_KEY_PACKET;
          }
          throw new Error(
            `Invalid AuthMoreData packet received by ${PLUGIN_NAME} plugin in STATE_TOKEN_SENT state.`
          );
        case STATE_WAIT_SERVER_KEY:
          if (pluginOptions.onServerPublicKey) {
            pluginOptions.onServerPublicKey(data);
          }
          return authWithKey(data);
        case STATE_FINAL:
          throw new Error(
            `Unexpected data in AuthMoreData packet received by ${PLUGIN_NAME} plugin in STATE_FINAL state.`
          );
      }

      throw new Error(
        `Unexpected data in AuthMoreData packet received by ${PLUGIN_NAME} plugin in state ${state}`
      );
    };
  };

// Export the plugin factory as default
module.exports = pluginFactory;

// Export calculateToken for reuse in initial handshake optimization
module.exports.calculateToken = calculateToken;

View on GitHub (pinned to 8b1f829d37)

Solutions

Ensure auth plugin factories are not shared or cached across connections — let the driver build a fresh plugin per connection.
Reproduce on the latest mysql2 release and file an issue with the full connection config and server version.
Remove any monkey-patching of connection._authPlugin or the plugin's internal state.

Defensive patterns

Strategy: try-catch

Try / catch

try { await conn.connect(); } catch (e) { if (/Unexpected data in AuthMoreData.*state/.test(e.message)) { /* report upstream; do not retry on same socket */ conn.destroy(); } throw e; }

Prevention

Never cache or share a plugin factory's returned function across connections.
Reproduce on stock mysql2 latest before assuming application fault.

When it happens

Trigger: Corrupted in-memory state caused by a concurrent reuse of the plugin closure across two connections (the plugin factory returns a function holding closure-local state); a bug in a custom fork that mutates the plugin's state; memory corruption from native code.

Common situations: A user wraps and reuses the plugin factory output across connections instead of letting the driver instantiate it per connection; an incompatible mysql2 fork; extremely rare race in connection sharing.

Related errors

AI-assisted analysis of sidorares/node-mysql2@8b1f829d37 (2026-08-11). Data as JSON: /api/errors/dc4e7d63a27bb59b. Report an issue: GitHub.