CVE-2026-30951: Sequelize Node.js ORM SQLi Vulnerability

CVE-2026-30951 Overview

Sequelize, a popular Node.js Object-Relational Mapping (ORM) tool, contains a SQL injection vulnerability in versions prior to 6.37.8. The flaw exists in the JSON/JSONB where clause processing, specifically within the _traverseJSON() function. This function splits JSON path keys on :: to extract a cast type, which is then interpolated directly into CAST(... AS <type>) SQL statements without proper sanitization. An attacker who controls JSON object keys can inject arbitrary SQL statements and exfiltrate sensitive data from any accessible database table.

Critical Impact
Attackers can exploit this SQL injection vulnerability to extract sensitive data from any table in the database by manipulating JSON object keys in queries processed by the Sequelize ORM.

Affected Products

Sequelize versions prior to 6.37.8
Node.js applications using vulnerable Sequelize versions with JSON/JSONB where clause processing
Any application accepting user-controlled input in JSON object keys passed to Sequelize queries

Discovery Timeline

2026-03-10 - CVE-2026-30951 published to NVD
2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-30951

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) stems from improper input validation in Sequelize's JSON path processing. The _traverseJSON() function is responsible for parsing JSON path expressions to handle type casting operations. When processing JSON object keys, the function splits on the :: delimiter to identify cast type specifications.

The extracted cast type is then directly interpolated into a SQL CAST() expression without any sanitization or validation. This allows an attacker who can control the JSON object keys—typically through user-supplied input in API requests—to inject malicious SQL fragments that execute with the privileges of the database connection.

The vulnerability enables data exfiltration from any table accessible to the database user, making it particularly dangerous in multi-tenant applications or systems storing sensitive information.

Root Cause

The root cause is insufficient input validation in the _traverseJSON() function when processing JSON path keys containing the :: cast type delimiter. The function fails to validate or escape the extracted cast type before using it in SQL string construction, creating a classic SQL injection vector. Any user-controllable input that flows into JSON object keys processed by Sequelize's JSON/JSONB where clauses becomes a potential attack surface.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

Identifying an application endpoint that accepts JSON input processed through Sequelize's where clause with JSON/JSONB operations
Crafting a malicious JSON object with keys containing :: followed by SQL injection payloads
Sending the crafted request to the vulnerable endpoint
The injected SQL executes within the CAST() expression, allowing data extraction via techniques such as UNION-based injection, blind SQL injection, or error-based extraction

The vulnerability allows attackers to read confidential data from any database table accessible to the application's database user. Since it requires no privileges and can be exploited remotely, it represents a significant risk to affected applications.

Detection Methods for CVE-2026-30951

Indicators of Compromise

Unusual database queries containing unexpected CAST() expressions with non-standard type names
Application logs showing JSON keys with :: followed by SQL syntax (e.g., SELECT, UNION, parentheses)
Database audit logs revealing queries accessing tables not typically used by the application
Increased database errors related to SQL syntax in CAST operations

Detection Strategies

Monitor application logs for JSON input containing suspicious patterns like :: followed by SQL keywords
Implement database query logging and analyze for anomalous CAST expressions
Deploy Web Application Firewall (WAF) rules to detect SQL injection patterns in JSON payloads
Use runtime application self-protection (RASP) tools to detect SQL injection attempts at the ORM layer

Monitoring Recommendations

Enable verbose logging for Sequelize query generation to capture constructed SQL statements
Configure database audit logging to track all executed queries and identify injection attempts
Set up alerting for database queries that access sensitive tables outside normal application patterns
Monitor for error rates in database connections that may indicate injection probe attempts

How to Mitigate CVE-2026-30951

Immediate Actions Required

Upgrade Sequelize to version 6.37.8 or later immediately
Audit application code for any user-controlled input flowing into JSON object keys used in Sequelize queries
Review database access logs for signs of exploitation prior to patching
Consider implementing additional input validation on JSON keys at the application layer

Patch Information

The vulnerability is fixed in Sequelize version 6.37.8. Organizations should update their package.json dependencies and redeploy affected applications. For detailed information about the security fix, refer to the GitHub Security Advisory.

Workarounds

Implement strict input validation to reject JSON keys containing :: characters from untrusted sources
Use parameterized queries or raw query methods with proper escaping for sensitive operations
Apply web application firewall rules to block requests with SQL injection patterns in JSON payloads
Restrict database user privileges to minimize the impact of potential data exfiltration

bash

# Update Sequelize to patched version
npm update sequelize@6.37.8

# Verify installed version
npm list sequelize