CVE-2025-29744 Overview
CVE-2025-29744 is a SQL Injection vulnerability [CWE-89] affecting the pg-promise Node.js library before version 11.5.5. The library improperly handles negative numbers when constructing SQL queries. Attackers can craft malicious numeric inputs that break out of expected query structure and execute unintended SQL statements.
The flaw stems from how pg-promise formats negative numeric values without accounting for SQL comment syntax. A crafted negative value can introduce a double-dash sequence that comments out trailing query logic. This enables injection in applications that pass user-controlled numeric input through the library's query formatting functions.
Critical Impact
Attackers who supply crafted numeric input to applications using vulnerable pg-promise versions can manipulate SQL query logic, potentially exposing or modifying database records.
Affected Products
- vitaly-t pg-promise versions prior to 11.5.5
- Node.js applications using pg-promise for PostgreSQL query construction
- Downstream packages depending on vulnerable pg-promise releases
Discovery Timeline
- 2025-06-12 - CVE-2025-29744 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-29744
Vulnerability Analysis
The vulnerability resides in how pg-promise formats numeric parameters when they are negative. SQL comment syntax uses -- to comment out the remainder of a line. When a negative number is concatenated adjacent to another negative value or numeric expression, the resulting -- sequence terminates the intended SQL logic. Attackers can exploit this to nullify WHERE clauses, bypass filters, or append conditions that alter query behavior.
The issue is subtle because numeric input is often assumed safe from injection. Developers typically apply strict escaping to string parameters while treating integers as low-risk. This mismatch between developer expectation and library behavior creates the attack surface. Full technical background appears in the SonarSource Blog on SQL Injection and the GitHub Discussion on pg-promise.
Root Cause
The root cause is missing sanitization of the leading minus sign in numeric formatting. When pg-promise produces output such as WHERE id = -1 followed immediately by another -value in a concatenated query, the two dashes merge into an inline SQL comment. The library did not detect or escape this dangerous adjacency prior to version 11.5.5.
Attack Vector
Exploitation requires network-accessible application logic that passes attacker-controlled numeric values to pg-promise query methods. User interaction is required, typically in the form of submitting crafted form data or API parameters. No authentication is required when the vulnerable endpoint is public. The attacker supplies a negative number that combines with subsequent query fragments to form a comment sequence.
Descriptive exploitation details are documented in the referenced advisory. The pattern involves supplying a negative integer where the resulting formatted SQL produces -- before a critical clause, causing the database engine to ignore the rest of the statement.
Detection Methods for CVE-2025-29744
Indicators of Compromise
- PostgreSQL query logs containing unexpected -- sequences following numeric parameters
- Application logs showing negative integer inputs on fields that should accept only positive values
- Anomalous query results such as unexpectedly broad record sets returned from filtered queries
Detection Strategies
- Perform software composition analysis to identify pg-promise versions below 11.5.5 across Node.js projects
- Enable PostgreSQL statement logging and search for double-dash sequences adjacent to bound parameters
- Review application code for query patterns that concatenate numeric input into SQL strings without parameter binding
Monitoring Recommendations
- Alert on database queries with abnormal row counts relative to historical baselines for filtered endpoints
- Track HTTP request parameters containing negative values on numeric fields that expect positive integers
- Monitor package manifests in CI/CD pipelines for outdated pg-promise versions
How to Mitigate CVE-2025-29744
Immediate Actions Required
- Upgrade pg-promise to version 11.5.5 or later in all Node.js applications
- Audit application code for direct concatenation of numeric inputs into SQL query templates
- Validate numeric input at the application boundary to reject values outside expected ranges
Patch Information
The maintainer resolved the issue in pg-promise version 11.5.5. Update the dependency via npm install pg-promise@^11.5.5 or the equivalent Yarn command. Review the GitHub Discussion on pg-promise for maintainer guidance on the fix and safe query construction practices.
Workarounds
- Use parameterized queries with named or indexed placeholders instead of string interpolation for numeric values
- Enforce strict input validation that rejects negative numbers on fields where they are not semantically valid
- Wrap numeric inputs in explicit type casts such as ::int on the SQL side to fail early on malformed input
# Upgrade pg-promise to the patched release
npm install pg-promise@^11.5.5
# Verify the installed version
npm ls pg-promise
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
