CVE-2026-30951: Sequelize Node.js ORM SQLi Vulnerability

CVE-2026-30951 Overview

Sequelize, a popular Node.js Object-Relational Mapping (ORM) tool, contains a SQL injection vulnerability in versions prior to 6.37.8. The flaw exists in the JSON/JSONB where clause processing, specifically within the _traverseJSON() function. This function splits JSON path keys on :: to extract a cast type, which is then interpolated directly into CAST(... AS <type>) SQL statements without proper sanitization. An attacker who controls JSON object keys can inject arbitrary SQL statements and exfiltrate sensitive data from any accessible database table.

Critical Impact

Attackers can exploit this SQL injection vulnerability to extract sensitive data from any table in the database by manipulating JSON object keys in queries processed by the Sequelize ORM.

Affected Products

• Sequelize versions prior to 6.37.8
• Node.js applications using vulnerable Sequelize versions with JSON/JSONB where clause processing
• Any application accepting user-controlled input in JSON object keys passed to Sequelize queries

Discovery Timeline

• 2026-03-10 - CVE-2026-30951 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-30951

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) stems from improper input validation in Sequelize's JSON path processing. The _traverseJSON() function is responsible for parsing JSON path expressions to handle type casting operations. When processing JSON object keys, the function splits on the :: delimiter to identify cast type specifications.

The extracted cast type is then directly interpolated into a SQL CAST() expression without any sanitization or validation. This allows an attacker who can control the JSON object keys—typically through user-supplied input in API requests—to inject malicious SQL fragments that execute with the privileges of the database connection.

The vulnerability enables data exfiltration from any table accessible to the database user, making it particularly dangerous in multi-tenant applications or systems storing sensitive information.

Root Cause

The root cause is insufficient input validation in the _traverseJSON() function when processing JSON path keys containing the :: cast type delimiter. The function fails to validate or escape the extracted cast type before using it in SQL string construction, creating a classic SQL injection vector. Any user-controllable input that flows into JSON object keys processed by Sequelize's JSON/JSONB where clauses becomes a potential attack surface.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying an application endpoint that accepts JSON input processed through Sequelize's where clause with JSON/JSONB operations
2. Crafting a malicious JSON object with keys containing :: followed by SQL injection payloads
3. Sending the crafted request to the vulnerable endpoint
4. The injected SQL executes within the CAST() expression, allowing data extraction via techniques such as UNION-based injection, blind SQL injection, or error-based extraction

The vulnerability allows attackers to read confidential data from any database table accessible to the application's database user. Since it requires no privileges and can be exploited remotely, it represents a significant risk to affected applications.

Detection Methods for CVE-2026-30951

Indicators of Compromise

• Unusual database queries containing unexpected CAST() expressions with non-standard type names
• Application logs showing JSON keys with :: followed by SQL syntax (e.g., SELECT, UNION, parentheses)
• Database audit logs revealing queries accessing tables not typically used by the application
• Increased database errors related to SQL syntax in CAST operations

Detection Strategies

• Monitor application logs for JSON input containing suspicious patterns like :: followed by SQL keywords
• Implement database query logging and analyze for anomalous CAST expressions
• Deploy Web Application Firewall (WAF) rules to detect SQL injection patterns in JSON payloads
• Use runtime application self-protection (RASP) tools to detect SQL injection attempts at the ORM layer

Monitoring Recommendations

• Enable verbose logging for Sequelize query generation to capture constructed SQL statements
• Configure database audit logging to track all executed queries and identify injection attempts
• Set up alerting for database queries that access sensitive tables outside normal application patterns
• Monitor for error rates in database connections that may indicate injection probe attempts

How to Mitigate CVE-2026-30951

Immediate Actions Required

• Upgrade Sequelize to version 6.37.8 or later immediately
• Audit application code for any user-controlled input flowing into JSON object keys used in Sequelize queries
• Review database access logs for signs of exploitation prior to patching
• Consider implementing additional input validation on JSON keys at the application layer

Patch Information

The vulnerability is fixed in Sequelize version 6.37.8. Organizations should update their package.json dependencies and redeploy affected applications. For detailed information about the security fix, refer to the GitHub Security Advisory.

Workarounds

• Implement strict input validation to reject JSON keys containing :: characters from untrusted sources
• Use parameterized queries or raw query methods with proper escaping for sensitive operations
• Apply web application firewall rules to block requests with SQL injection patterns in JSON payloads
• Restrict database user privileges to minimize the impact of potential data exfiltration

# Update Sequelize to patched version
npm update sequelize@6.37.8

# Verify installed version
npm list sequelize