npmPackage

sequelize

15 known vulnerabilities (4 critical, 1 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release: 6.37.8 (Mar 7, 2026): no advisory affects it
Newest unaffected release: 6.37.8 (Mar 7, 2026), the latest release
Advisories: 15 · 4 critical, 1 high, 1 medium

Weekly downloads: 4.1M
Dependents: 3,646
Releases: 500+ since 3.4.1 (Jul 16, 2015)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2026-69240
Affects 0.0.0-development to 6.37.3 (6.37.4 is outside it)
CVE-2026-30951
Affects 6.0.0-beta.1 to 6.37.7 (6.37.8 is outside it)
CVE-2023-25813
Affects 0.0.0-development to 6.19.0 (6.19.1 is outside it)
CVE-2023-22579
Affects 0.0.0-development to 6.28.0 (6.28.1 is outside it)
CVE-2023-22578
Affects 0.0.0-development to 6.28.2 (6.29.0 is outside it)
CVE-2023-22580
Affects 0.0.0-development to 6.28.0 (6.28.1 is outside it)
CVE-2019-10749
Affects 0.0.0-development to 3.35.0 (3.35.1 is outside it)
CVE-2019-10748
Affects 0.0.0-development to 3.35.0 (3.35.1 is outside it); 4.0.0 to 4.44.2 (4.44.3 is outside it); 5.1.0 to 5.8.10 (5.8.11 is outside it)
CVE-2019-10752
Affects 0.0.0-development to 4.44.2 (4.44.3 is outside it); 5.1.0 to 5.15.0 (5.15.1 is outside it)
CVE-2019-11069
Affects 5.1.0 to 5.2.15 (5.3.0 is outside it)
CVE-2016-10554
Affects 0.0.0-development (3.4.1 is outside it)
CVE-2016-10553
Affects 0.0.0-development (3.4.1 is outside it)

Show all 15 advisoriesShow fewer advisories

CVE-2016-10550
Affects 0.0.0-development to 3.16.0 (3.17.0 is outside it)
CVE-2016-10556
Affects 0.0.0-development to 3.19.3 (3.20.0 is outside it)
CVE-2015-1369
Affects 0.0.0-development (3.4.1 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 15

CVE-2026-69240Critical 9.8
Sequelize: SQL Injection (Oracle DB)
Affected: fixed in 6.37.4.
Fixed in 6.37.4 (released Oct 4, 2024, 668 days before disclosure).
The latest release, 6.37.8, is not affected.
17% of sequelize downloads last week were affected versions (827.1K).
CVE-2026-30951High 7.5
Sequelize v6 Vulnerable to SQL Injection via JSON Column Cast Type
Affected: from 6.0.0-beta.1, fixed in 6.37.8.
Fixed in 6.37.8 (released Mar 7, 2026, 3 days before disclosure).
The latest release, 6.37.8, is not affected.
33% of sequelize downloads last week were affected versions (1.6M).
CVE-2023-25813Critical 10.0
SQL Injection via replacements in sequelize
Affected: fixed in 6.19.1.
Fixed in 6.19.1 (released May 17, 2022, 281 days before disclosure).
The latest release, 6.37.8, is not affected.
7.6% of sequelize downloads last week were affected versions (366K).
CVE-2023-22579Critical 9.9
Sequalize - Unsafe fall-through in getWhereConditions
Affected: fixed in 6.28.1.
Fixed in 6.28.1 (released Feb 21, 2023, 5 days after disclosure).
The latest release, 6.37.8, is not affected.
8.6% of sequelize downloads last week were affected versions (412.1K).
CVE-2023-22578Critical 10.0
Sequalize - Default support for “raw attributes” when using parentheses
Affected: fixed in 6.29.0.
Fixed in 6.29.0 (released Feb 23, 2023, 7 days after disclosure).
The latest release, 6.37.8, is not affected.
8.6% of sequelize downloads last week were affected versions (413K).
CVE-2023-22580Medium 5.3
Sequalize - Bad query filtering leading to SQL errors
Affected: fixed in 6.28.1.
Fixed in 6.28.1 (released Feb 21, 2023, 5 days after disclosure).
The latest release, 6.37.8, is not affected.
8.6% of sequelize downloads last week were affected versions (412.1K).
CVE-2019-10749Unrated
sequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not being properly sanitized in the…
Affected: fixed in 3.35.1.
Fixed in 3.35.1 (released Jun 21, 2019, 130 days before disclosure).
The latest release, 6.37.8, is not affected.
0.3% of sequelize downloads last week were affected versions (13.9K).
CVE-2019-10748Unrated
Sequelize all versions prior to 3.35.1, 4.44.3, and 5.8.11 are vulnerable to SQL Injection due to JSON path keys not being properly…
Affected: fixed in 3.35.1; from 4.0.0, fixed in 4.44.3; from 5.0.0, fixed in 5.8.11.
Fixed in 3.35.1 (released Jun 21, 2019, 129 days before disclosure), 4.44.3 (released Aug 18, 2019, 71 days before disclosure) and 5.8.11 (released Jun 21, 2019, 129 days before disclosure).
The latest release, 6.37.8, is not affected.
0.9% of sequelize downloads last week were affected versions (45.4K).
CVE-2019-10752Unrated
Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json() helper function not…
Affected: fixed in 4.44.3; from 5.0.0, fixed in 5.15.1.
Fixed in 4.44.3 (released Aug 18, 2019, 60 days before disclosure) and 5.15.1 (released Aug 18, 2019, 60 days before disclosure).
The latest release, 6.37.8, is not affected.
1.3% of sequelize downloads last week were affected versions (61.2K).
CVE-2019-11069Unrated
Sequelize version 5 before 5.3.0 does not properly ensure that standard conforming strings are used.
Affected: from 5.0.0, fixed in 5.3.0.
Fixed in 5.3.0 (released Apr 10, 2019, the day of disclosure).
The latest release, 6.37.8, is not affected.
<0.1% of sequelize downloads last week were affected versions (4.8K).
CVE-2016-10554Unrated
sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server…
Affected: fixed in 1.7.0.
Fixed in 3.4.1 (released Jul 16, 2015, 1050 days before disclosure, the advisory names 1.7.0, which was never published).
The latest release, 6.37.8, is not affected.
<0.1% of sequelize downloads last week were affected versions (1.7K).
CVE-2016-10553Unrated
sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server…
Affected: fixed in 3.0.0.
Fixed in 3.4.1 (released Jul 16, 2015, 1050 days before disclosure, the advisory names 3.0.0, which was never published).
The latest release, 6.37.8, is not affected.
<0.1% of sequelize downloads last week were affected versions (4.2K).
CVE-2016-10550Unrated
sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server…
Affected: fixed in 3.17.0.
Fixed in 3.17.0 (released Jan 6, 2016, 876 days before disclosure).
The latest release, 6.37.8, is not affected.
0.1% of sequelize downloads last week were affected versions (6.2K).
CVE-2016-10556Unrated
sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server…
Affected: fixed in 3.20.0.
Fixed in 3.20.0 (released Mar 21, 2016, 799 days before disclosure).
The latest release, 6.37.8, is not affected.
0.1% of sequelize downloads last week were affected versions (6.7K).
CVE-2015-1369Unrated
SQL injection vulnerability in Sequelize before 2.0.0-rc7 for Node.js allows remote attackers to execute arbitrary SQL commands via the…
Affected: fixed in 2.0.0-rc8.
Fixed in 3.4.1 (released Jul 16, 2015, 170 days after disclosure, the advisory names 2.0.0-rc8, which was never published).
The latest release, 6.37.8, is not affected.
<0.1% of sequelize downloads last week were affected versions (3.4K).