Which versions of PostgreSQL are affected by CVE-2026-4190?

A remote SQL injection vulnerability affecting node-api-postgres versions up to 2.5 has been publicly disclosed with an available exploit, creating immediate risk for any applications using this…

Is there a public PoC exploit available for CVE-2026-4190?

Yes, a public proof-of-concept exploit is available for CVE-2026-4190. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4190?

Within 24 hours: Inventory all applications using node-api-postgres and identify those running versions 2.5 or earlier; implement network-level monitoring for suspicious database queries. Within 7 days: Evaluate alternative libraries or migrate to a patched version if available from community sources; implement input validation and parameterized queries as interim controls. Within 30 days: Complete migration away from the vulnerable library or establish a long-term support plan with security testing; conduct incident response review for any unauthorized database access during the vulnerability window.

PostgreSQL CVE-2026-4190

Q: What is the CVSS score of CVE-2026-4190?

CVE-2026-4190 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-12251 MEDIUM

SQL Injection (CWE-89)

2026-03-15 VulDB

SQLi PostgreSQL

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Severity Changed

Apr 22, 2026 - 21:37 NVD

HIGH MEDIUM

CVSS changed

Apr 22, 2026 - 21:37 NVD

7.3 (HIGH) 6.9 (MEDIUM)

PoC Detected

Mar 16, 2026 - 14:53 vuln.today

Public exploit code

EUVD ID Assigned

Mar 15, 2026 - 20:00 euvd

EUVD-2026-12251

Analysis Generated

Mar 15, 2026 - 20:00 vuln.today

CVE Published

Mar 15, 2026 - 19:32 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was detected in JawherKl node-api-postgres up to 2.5. This impacts the function User.getAll of the file models/user.js. The manipulation of the argument sort results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

SQL injection in the User.getAll function of node-api-postgres up to version 2.5 allows remote attackers to manipulate the sort parameter and execute arbitrary SQL commands. Public exploit code exists for this vulnerability, and no patch is currently available from the vendor despite early disclosure notification. Affected deployments using PostgreSQL with the vulnerable Node.js API library face risks of unauthorized data access, modification, and potential service disruption.

Technical ContextAI

The node-api-postgres library is a Node.js API framework for PostgreSQL databases. The vulnerability stems from improper input sanitization in the User.getAll function located in models/user.js, where the 'sort' parameter is directly concatenated into SQL queries without proper escaping or parameterization. This is a classic SQL injection vulnerability (CWE-89), which occurs when user-supplied input is incorporated into SQL queries without adequate validation. Based on the CPE identifier (cpe:2.3:a:jawherkl:node-api-postgres:*:*:*:*:*:*:*:*), all versions up to and including 2.5 are affected.

RemediationAI

Given the vendor's non-responsiveness to the vulnerability disclosure, no official patch is available. Recommended mitigations include: 1) Immediately implement input validation and parameterized queries for the sort parameter in User.getAll function, 2) Consider forking the library and applying security fixes if continued use is necessary, 3) Migrate to an alternative, actively maintained PostgreSQL library for Node.js, 4) Implement Web Application Firewall (WAF) rules to filter potential SQL injection attempts as a temporary measure. Review the exploit details at https://hackmd.io/@YzU_KiOzT86cEbFQdBceVg/Bk56LQQYbe to understand attack patterns for detection.