# sequelize (npm) vulnerabilities 15 known vulnerabilities (4 critical, 1 high, 1 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 6.37.8 (Mar 7, 2026): no advisory affects it - Newest unaffected release: 6.37.8 (Mar 7, 2026), the latest release - Weekly downloads: 4.1M - Dependents: 3,646 - Releases: 500+ since 3.4.1 (Jul 16, 2015) - Registry: https://www.npmjs.com/package/sequelize - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-69240: 0.0.0-development to 6.37.3 (6.37.4 is outside it) - CVE-2026-30951: 6.0.0-beta.1 to 6.37.7 (6.37.8 is outside it) - CVE-2023-25813: 0.0.0-development to 6.19.0 (6.19.1 is outside it) - CVE-2023-22579: 0.0.0-development to 6.28.0 (6.28.1 is outside it) - CVE-2023-22578: 0.0.0-development to 6.28.2 (6.29.0 is outside it) - CVE-2023-22580: 0.0.0-development to 6.28.0 (6.28.1 is outside it) - CVE-2019-10749: 0.0.0-development to 3.35.0 (3.35.1 is outside it) - CVE-2019-10748: 0.0.0-development to 3.35.0 (3.35.1 is outside it); 4.0.0 to 4.44.2 (4.44.3 is outside it); 5.1.0 to 5.8.10 (5.8.11 is outside it) - CVE-2019-10752: 0.0.0-development to 4.44.2 (4.44.3 is outside it); 5.1.0 to 5.15.0 (5.15.1 is outside it) - CVE-2019-11069: 5.1.0 to 5.2.15 (5.3.0 is outside it) - CVE-2016-10554: 0.0.0-development (3.4.1 is outside it) - CVE-2016-10553: 0.0.0-development (3.4.1 is outside it) - CVE-2016-10550: 0.0.0-development to 3.16.0 (3.17.0 is outside it) - CVE-2016-10556: 0.0.0-development to 3.19.3 (3.20.0 is outside it) - CVE-2015-1369: 0.0.0-development (3.4.1 is outside it) Older releases aren't stored, so the earliest spans may start sooner. ## Advisories (15) ### [CVE-2026-69240](https://cve.now/CVE-2026-69240): Sequelize: SQL Injection (Oracle DB) - Severity: Critical 9.8 - Published: Aug 3, 2026 - Affected: fixed in 6.37.4. - Fixed in 6.37.4 (released Oct 4, 2024, 668 days before disclosure). - The latest release, 6.37.8, is not affected. - 17% of sequelize downloads last week were affected versions (827.1K). ### [CVE-2026-30951](https://cve.now/CVE-2026-30951): Sequelize v6 Vulnerable to SQL Injection via JSON Column Cast Type - Severity: High 7.5 - Published: Mar 10, 2026 - Affected: from 6.0.0-beta.1, fixed in 6.37.8. - Fixed in 6.37.8 (released Mar 7, 2026, 3 days before disclosure). - The latest release, 6.37.8, is not affected. - 33% of sequelize downloads last week were affected versions (1.6M). ### [CVE-2023-25813](https://cve.now/CVE-2023-25813): SQL Injection via replacements in sequelize - Severity: Critical 10.0 - Published: Feb 22, 2023 - Affected: fixed in 6.19.1. - Fixed in 6.19.1 (released May 17, 2022, 281 days before disclosure). - The latest release, 6.37.8, is not affected. - 7.6% of sequelize downloads last week were affected versions (366K). ### [CVE-2023-22579](https://cve.now/CVE-2023-22579): Sequalize - Unsafe fall-through in getWhereConditions - Severity: Critical 9.9 - Published: Feb 16, 2023 - Affected: fixed in 6.28.1. - Fixed in 6.28.1 (released Feb 21, 2023, 5 days after disclosure). - The latest release, 6.37.8, is not affected. - 8.6% of sequelize downloads last week were affected versions (412.1K). ### [CVE-2023-22578](https://cve.now/CVE-2023-22578): Sequalize - Default support for “raw attributes” when using parentheses - Severity: Critical 10.0 - Published: Feb 16, 2023 - Affected: fixed in 6.29.0. - Fixed in 6.29.0 (released Feb 23, 2023, 7 days after disclosure). - The latest release, 6.37.8, is not affected. - 8.6% of sequelize downloads last week were affected versions (413K). ### [CVE-2023-22580](https://cve.now/CVE-2023-22580): Sequalize - Bad query filtering leading to SQL errors - Severity: Medium 5.3 - Published: Feb 16, 2023 - Affected: fixed in 6.28.1. - Fixed in 6.28.1 (released Feb 21, 2023, 5 days after disclosure). - The latest release, 6.37.8, is not affected. - 8.6% of sequelize downloads last week were affected versions (412.1K). ### [CVE-2019-10749](https://cve.now/CVE-2019-10749): sequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not being properly sanitized in the… - Severity: Unrated - Published: Oct 29, 2019 - Affected: fixed in 3.35.1. - Fixed in 3.35.1 (released Jun 21, 2019, 130 days before disclosure). - The latest release, 6.37.8, is not affected. - 0.3% of sequelize downloads last week were affected versions (13.9K). ### [CVE-2019-10748](https://cve.now/CVE-2019-10748): Sequelize all versions prior to 3.35.1, 4.44.3, and 5.8.11 are vulnerable to SQL Injection due to JSON path keys not being properly… - Severity: Unrated - Published: Oct 28, 2019 - Affected: fixed in 3.35.1; from 4.0.0, fixed in 4.44.3; from 5.0.0, fixed in 5.8.11. - Fixed in 3.35.1 (released Jun 21, 2019, 129 days before disclosure), 4.44.3 (released Aug 18, 2019, 71 days before disclosure) and 5.8.11 (released Jun 21, 2019, 129 days before disclosure). - The latest release, 6.37.8, is not affected. - 0.9% of sequelize downloads last week were affected versions (45.4K). ### [CVE-2019-10752](https://cve.now/CVE-2019-10752): Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json() helper function not… - Severity: Unrated - Published: Oct 17, 2019 - Affected: fixed in 4.44.3; from 5.0.0, fixed in 5.15.1. - Fixed in 4.44.3 (released Aug 18, 2019, 60 days before disclosure) and 5.15.1 (released Aug 18, 2019, 60 days before disclosure). - The latest release, 6.37.8, is not affected. - 1.3% of sequelize downloads last week were affected versions (61.2K). ### [CVE-2019-11069](https://cve.now/CVE-2019-11069): Sequelize version 5 before 5.3.0 does not properly ensure that standard conforming strings are used. - Severity: Unrated - Published: Apr 10, 2019 - Affected: from 5.0.0, fixed in 5.3.0. - Fixed in 5.3.0 (released Apr 10, 2019, the day of disclosure). - The latest release, 6.37.8, is not affected. - <0.1% of sequelize downloads last week were affected versions (4.8K). ### [CVE-2016-10554](https://cve.now/CVE-2016-10554): sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server… - Severity: Unrated - Published: May 31, 2018 - Affected: fixed in 1.7.0. - Fixed in 3.4.1 (released Jul 16, 2015, 1050 days before disclosure, the advisory names 1.7.0, which was never published). - The latest release, 6.37.8, is not affected. - <0.1% of sequelize downloads last week were affected versions (1.7K). ### [CVE-2016-10553](https://cve.now/CVE-2016-10553): sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server… - Severity: Unrated - Published: May 31, 2018 - Affected: fixed in 3.0.0. - Fixed in 3.4.1 (released Jul 16, 2015, 1050 days before disclosure, the advisory names 3.0.0, which was never published). - The latest release, 6.37.8, is not affected. - <0.1% of sequelize downloads last week were affected versions (4.2K). ### [CVE-2016-10550](https://cve.now/CVE-2016-10550): sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server… - Severity: Unrated - Published: May 31, 2018 - Affected: fixed in 3.17.0. - Fixed in 3.17.0 (released Jan 6, 2016, 876 days before disclosure). - The latest release, 6.37.8, is not affected. - 0.1% of sequelize downloads last week were affected versions (6.2K). ### [CVE-2016-10556](https://cve.now/CVE-2016-10556): sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server… - Severity: Unrated - Published: May 29, 2018 - Affected: fixed in 3.20.0. - Fixed in 3.20.0 (released Mar 21, 2016, 799 days before disclosure). - The latest release, 6.37.8, is not affected. - 0.1% of sequelize downloads last week were affected versions (6.7K). ### [CVE-2015-1369](https://cve.now/CVE-2015-1369): SQL injection vulnerability in Sequelize before 2.0.0-rc7 for Node.js allows remote attackers to execute arbitrary SQL commands via the… - Severity: Unrated - Published: Jan 27, 2015 - Affected: fixed in 2.0.0-rc8. - Fixed in 3.4.1 (released Jul 16, 2015, 170 days after disclosure, the advisory names 2.0.0-rc8, which was never published). - The latest release, 6.37.8, is not affected. - <0.1% of sequelize downloads last week were affected versions (3.4K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/sequelize Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.