node-mysql2 accepts a server-initiated switch to the mysql_clear_password authentication plugin without requiring explicit opt-in, so the client transmits the password in plaintext. A malicious or DNS-hijacked server can request cleartext authentication and capture credentials even when the connection is not encrypted. Fixed in 3.22.0, which gates the built-in plugin behind a new enableCleartextPlugin option (or a custom mysql_clear_password entry in authPlugins) and otherwise fails the connection with MYSQL_CLEAR_PASSWORD_NOT_ENABLED.