NoSQL Injection in sequelize
Summary
GHSA-wfp9-vr4j-f49j: NoSQL Injection in sequelize. Affects sequelize versions < 4.12.0. Fixed in 4.12.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Sequelize is an Object-Relational Mapping (ORM) library for Node.js that provides easy access to databases by mapping database entries to JavaScript objects. It is commonly used with SQL databases such as MySQL, PostgreSQL, and SQLite. However, versions of sequelize prior to 4.12.0 are vulnerable to NoSQL Injection.
Vulnerability Detail
NoSQL Injection is a type of injection attack that targets NoSQL databases. In the case of sequelize, query operators such as $gt are not properly sanitized, allowing an attacker to manipulate data queries. This can lead to unauthorized access, data manipulation, or even data loss. The vulnerability has a severity rating of HIGH (CWE-89).
How To Fix
Latest published version: 6.37.8 as of 23 Oct 2026
npm install sequelize@6.37.8Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.12.0
This is the first release that contains the fix.
npm install sequelize@4.12.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
NoSQL Injection in sequelize can lead to serious security issues, including unauthorized access and data manipulation. It is crucial to upgrade to version 4.12.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for sequelize →
FAQ
NoSQL Injection is a type of injection attack that targets NoSQL databases. It involves manipulating data queries by exploiting vulnerabilities in the application's input validation and query construction.
NoSQL Injection can lead to unauthorized access, data manipulation, or even data loss. Attackers can bypass authentication, retrieve sensitive information, modify or delete data, and perform other malicious actions.
NoSQL Injection and SQL Injection are similar in concept but target different types of databases. SQL Injection attacks exploit vulnerabilities in SQL databases, while NoSQL Injection attacks target NoSQL databases, which use different query languages and data structures.
Yes, NoSQL Injection can be prevented by properly validating and sanitizing user input, using parameterized queries or prepared statements, and implementing strict access controls and authentication mechanisms.
Yes, upgrading to version 4.12.0 or later of sequelize includes the necessary fixes to prevent NoSQL Injection. It is recommended to always use the latest stable version of the library to ensure the best security.
References
Related vulnerabilities
Recent vulnerabilities recorded for sequelize.
