# @mikro-orm/core (npm) vulnerabilities 2 known vulnerabilities (1 critical, 1 high), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 7.2.8 (Nov 6, 2026): no advisory affects it - Newest unaffected release: 7.2.8 (Nov 6, 2026), the latest release - Weekly downloads: 1.4M - Dependents: 101 - Releases: 500+ since 6.6.15 (Jun 17, 2026) - Registry: https://www.npmjs.com/package/@mikro-orm/core - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-34220: no published release is affected - CVE-2026-34221: no published release is affected Older releases aren't stored, so the earliest spans may start sooner. ## Advisories (2) ### [CVE-2026-34220](https://cve.now/CVE-2026-34220): MikroORM is vulnerable to SQL Injection via specially crafted object - Severity: Critical 9.3 - Published: Mar 31, 2026 - Affected: fixed in 6.6.10; from 7.0.0-dev.0, fixed in 7.0.6. - Fixed in 6.6.10 and 7.1.4 (released Jun 6, 2026, 67 days after disclosure, the advisory names 7.0.6, which was never published). - The latest release, 7.2.8, is not affected. - 21% of @mikro-orm/core downloads last week were affected versions (337.3K). ### [CVE-2026-34221](https://cve.now/CVE-2026-34221): MikroORM has Prototype Pollution in Utils.merge - Severity: High 8.3 - Published: Mar 31, 2026 - Affected: fixed in 6.6.10; from 7.0.0-dev.0, fixed in 7.0.6. - Fixed in 6.6.10 and 7.1.4 (released Jun 6, 2026, 67 days after disclosure, the advisory names 7.0.6, which was never published). - The latest release, 7.2.8, is not affected. - 21% of @mikro-orm/core downloads last week were affected versions (337.3K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/@mikro-orm/core Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.