CVE-2026-30951 Sequelize v6 Vulnerable to SQL Injection via JSON Column Cast Type
Attackers can inject arbitrary SQL via JSON column cast types in Sequelize, allowing data exfiltration from any table.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-30951?
CVE-2026-30951 is a high-severity SQL injection vulnerability in sequelize, published on 10 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Sequelize is a Node.js ORM tool. Prior to 6.37.8, there is SQL injection via unescaped cast type in JSON/JSONB where clause processing. The _traverseJSON() function splits JSON path keys on :: to extract a cast type, which is interpolated raw into CAST(... AS <type>) SQL. An attacker who controls JSON object keys can inject arbitrary SQL and exfiltrate data from any table. This vulnerability is fixed in 6.37.8.
Weakness: CWE-89
Which versions are affected by CVE-2026-30951?
2 open source packages ship an affected version, including sequelize. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
sequelize npm | From 6.0.0-beta.1 | 6.37.8 |
sequelize npm | From 6.0.0-beta.1 | 6.37.8 |
Products include Sequelizejs Sequelize.
How do I fix CVE-2026-30951?
Upgrade sequelize to 6.37.8 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-30951 being exploited?
There is no known exploitation of CVE-2026-30951 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in sequelize
Sources
Also known as CLEANSTART-2026-AK68304, CLEANSTART-2026-YB83970, CLSA-2026-1792476615, GHSA-6457-6jrx-69cr.