What is the CVSS score of CVE-2026-30951?

CVE-2026-30951 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Node.js are affected by CVE-2026-30951?

Applications using Sequelize ORM versions prior to 6.37.8 are vulnerable to SQL injection attacks through improperly escaped JSON/JSONB filtering, potentially allowing attackers to access, modify, or…. A patch is available.

How to fix or mitigate CVE-2026-30951?

Within 24 hours: Identify all Node.js applications using Sequelize and document version numbers; assess whether JSON/JSONB filtering is used in production queries. Within 7 days: Implement input validation and parameterized query patterns to avoid dynamic JSON casting; deploy WAF rules to detect SQL injection patterns in application traffic; segment database access with least-privilege credentials. Within 30 days: Upgrade to Sequelize 6.37.8 or later when available; conduct code audit of all JSON/JSONB where clause implementations; perform penetration testing on affected query paths.

Node.js CVE-2026-30951

HIGH

SQL Injection (CWE-89)

2026-03-10 security-advisories@github.com

GHSA-6457-6jrx-69cr

Node.js SQLi Sequelize

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Red Hat

7.5 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 21:16 nvd

HIGH 7.5

DescriptionNVD

Sequelize is a Node.js ORM tool. Prior to 6.37.8, there is SQL injection via unescaped cast type in JSON/JSONB where clause processing. The _traverseJSON() function splits JSON path keys on :: to extract a cast type, which is interpolated raw into CAST(... AS <type>) SQL. An attacker who controls JSON object keys can inject arbitrary SQL and exfiltrate data from any table. This vulnerability is fixed in 6.37.8.

AnalysisAI

SQL injection in Sequelize prior to version 6.37.8 allows unauthenticated attackers to execute arbitrary SQL queries and extract sensitive data by manipulating JSON object keys in WHERE clause operations. The vulnerability stems from improper sanitization of cast type parameters in the _traverseJSON() function, which directly interpolates user-controlled input into CAST SQL statements. Node.js applications using affected Sequelize versions are at risk of complete database compromise.

Technical ContextAI

Classified as CWE-89 (SQL Injection). Affects Sequelize is a Node.js ORM tool.. Sequelize is a Node.js ORM tool. Prior to 6.37.8, there is SQL injection via unescaped cast type in JSON/JSONB where clause processing. The _traverseJSON() function splits JSON path keys on :: to extract a cast type, which is interpolated raw into CAST(... AS <type>) SQL. An attacker who controls JSON object keys can inject arbitrary SQL and exfiltrate data from any table. This vulnerability is fixed in 6.37.8.