CVE-2025-50979: NodeBB SQL Injection Vulnerability in Search Categories API
Summary
CVE-2025-50979: NodeBB SQL Injection vulnerability. Affects nodebb versions < 4.3.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NodeBB is an open-source forum software built on Node.js, designed to facilitate online discussions and community engagement. It offers features such as real-time notifications, customizable themes, and a plugin system for extended functionality. However, NodeBB versions up to 4.3.0 are vulnerable to a SQL injection flaw that can compromise the security of the application.
Vulnerability Detail
NodeBB v4.3.0 contains a SQL injection vulnerability in its search-categories API endpoint (/api/v3/search/categories). The issue arises from the lack of proper sanitization of the search query parameter, which allows unauthenticated remote attackers to execute boolean-based blind and PostgreSQL error-based payloads. This vulnerability can lead to unauthorized data access, manipulation, or even complete system compromise.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can restrict access to the vulnerable API endpoint by implementing authentication checks or by disabling the search functionality until the package is updated.
Conclusion
The SQL injection vulnerability in NodeBB v4.3.0 poses a significant security risk to applications using this forum software. It is crucial to update to the latest version to mitigate this risk and protect sensitive data from potential attacks.
See every vulnerability recorded for nodebb →
FAQ
The vulnerability is a SQL injection flaw that allows attackers to manipulate database queries through unsanitized input.
Any application using NodeBB version 4.3.0 or earlier is at risk of this SQL injection vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software by analyzing the package-lock.json file. Visit Vulert Scanner to check your application without needing to sign up.
If exploited, attackers could gain unauthorized access to sensitive data, manipulate database contents, or compromise the entire application.
Yes, updating NodeBB to the latest version will resolve this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodebb.
