CVE-2026-19351: node-sql-query SQLi Vulnerability

CVE-2026-19351 Overview

CVE-2026-19351 is a SQL injection vulnerability [CWE-74] in the dresende node-sql-query library, affecting versions 0.1.25, 0.1.26, 0.1.27, and 0.1.28. The flaw resides in the SelectQuery.from and SelectQuery.build functions within lib/Select.js, part of the Request Parameter Handler component. Attackers can manipulate query parameters to inject arbitrary SQL statements. The vulnerability is exploitable remotely without authentication or user interaction. A public exploit has been disclosed, increasing the likelihood of opportunistic abuse against exposed Node.js applications that depend on this library.

Critical Impact
Remote, unauthenticated attackers can inject SQL statements by manipulating join type input passed to SelectQuery.from, potentially compromising query integrity and exposing database contents.

Affected Products

dresende node-sql-query 0.1.25
dresende node-sql-query 0.1.26
dresende node-sql-query 0.1.27 and 0.1.28

Discovery Timeline

2026-08-09 - CVE-2026-19351 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-19351

Vulnerability Analysis

The node-sql-query library builds SQL statements programmatically for Node.js applications. In affected versions, the SelectQuery.from and SelectQuery.build functions in lib/Select.js accept a join type parameter that is concatenated directly into the resulting SQL string. Because the library does not validate this value against an allowlist, callers who forward user-controlled input to the join type argument enable SQL injection. Downstream applications that expose join type selection through HTTP request parameters inherit the flaw directly.

Exploitation depends on how the consuming application uses the library. Applications that pass request parameters into query builder arguments without sanitization allow attackers to break out of the intended SQL clause and append arbitrary SQL. This can result in data disclosure, unauthorized modification, or authentication bypass depending on database privileges.

Root Cause

The root cause is missing input validation on the join type argument. Before the fix, any string passed as a join type was inserted into the generated SQL. The patch 3414c42f6de89826fa1f5f36f6139d1e6552778e introduces an allowlist of accepted join keywords (INNER, LEFT, LEFT OUTER, RIGHT, RIGHT OUTER, FULL, FULL OUTER) and rejects any other value.

Attack Vector

The attack vector is network-based. An attacker submits a crafted request parameter that reaches the SelectQuery.from call inside a vulnerable Node.js application. The injected payload is concatenated into the generated SQL and executed by the backend database.

javascript

// Security patch in lib/Select.js (commit 3414c42f6de89826fa1f5f36f6139d1e6552778e)
// Adds an allowlist of accepted join types to prevent injection via the join argument
 	"CONV", "RANDOM", "RAND", "RADIANS", "DEGREES",
 	"SUM", "COUNT", "DISTINCT"
 ];
+var allowed_join_types = {
+	"INNER": true,
+	"LEFT": true,
+	"LEFT OUTER": true,
+	"RIGHT": true,
+	"RIGHT OUTER": true,
+	"FULL": true,
+	"FULL OUTER": true
+};
 
 exports.SelectQuery = SelectQuery;

Source: GitHub Commit Details

Detection Methods for CVE-2026-19351

Indicators of Compromise

Unexpected SQL keywords (UNION, SELECT, --, ;) appearing in HTTP request parameters bound to query builder arguments.
Database error messages logged in application output referencing malformed SQL near join clauses.
Anomalous outbound database queries containing join keywords concatenated with untrusted strings.

Detection Strategies

Perform a software composition analysis scan of package.json and package-lock.json for node-sql-query versions 0.1.25 through 0.1.28.
Review application code for callers that pass request parameters directly into SelectQuery.from or SelectQuery.build.
Deploy web application firewall rules that flag SQL metacharacters in parameters used by endpoints backed by this library.

Monitoring Recommendations

Enable database query logging and alert on syntactically unusual JOIN clauses.
Monitor Node.js application logs for uncaught database exceptions correlated with 4xx and 5xx responses.
Track dependency drift so that vulnerable versions do not reappear through transitive dependencies.

How to Mitigate CVE-2026-19351

Immediate Actions Required

Upgrade node-sql-query to version 0.1.29 or later, which contains commit 3414c42f6de89826fa1f5f36f6139d1e6552778e.
Audit application code paths that call SelectQuery.from and SelectQuery.build with any user-influenced input.
Rotate database credentials if evidence suggests the vulnerability was exercised in production.

Patch Information

The fix is delivered in node-sql-queryv0.1.29. The patch introduces an allowed_join_types allowlist that restricts the join type argument to a fixed set of SQL keywords. See the GitHub Release v0.1.29 and the GitHub Pull Request for details.

Workarounds

Validate join type arguments against a strict allowlist before passing them to the library if immediate upgrade is not possible.
Reject or encode SQL metacharacters in all HTTP parameters that reach the query builder.
Restrict database account privileges so that a successful injection cannot escalate beyond read access to intended tables.

bash

# Upgrade the affected dependency to the patched release
npm install sql-query@0.1.29 --save
npm ls sql-query