CVE-2026-30951

CVE-2026-30951 Sequelize JSON Cast SQL Injection ★ CVE-2026-30951 Sequelize ORM SQL Injection PoC ★ https://github.com/user-attachments/assets/30b19211-890a-4780-acd9-04856ec98381 Overview CVE-2026-30951 is a SQL Injection vulnerability in Sequelize v6 , a widely used Node.js ORM. The vulnerabili...

CVE-2026-30951

Sequelize is a Node.js ORM tool. Prior to 6.37.8, there is SQL injection via unescaped cast type in JSON/JSONB where clause processing. The traverseJSON function splits JSON path keys on :: to extract a cast type, which is interpolated raw into CAST... AS SQL. An attacker who controls JSON object...

PT-2026-24433

Name of the Vulnerable Software and Affected Versions Sequelize versions prior to 6.37.8 Description Sequelize, a Node.js ORM tool, contains a SQL injection flaw due to unescaped cast type handling within JSON/JSONB where clause processing. The traverseJSON function splits JSON path keys using ':...

CVE-2026-30951: Improper Neutralization of Special Elements used in an SQL Command

Sequelize is a Node.js ORM tool. Prior to 6.37.8, there is SQL injection via unescaped cast type in JSON/JSONB where clause processing. The traverseJSON function splits JSON path keys on :: to extract a cast type, which is interpolated raw into CAST... AS SQL. An attacker who controls JSON object...

Malicious code in @zalastax/nolb-jsonb (npm)

The package @zalastax/nolb-jsonb was found to contain malicious code...

MAL-2025-12130 Malicious code in @zalastax/nolb-jsonb (npm)

The package @zalastax/nolb-jsonb was found to contain malicious code...

com.radcortez.flyway:flyway-junit5-quarkus (1.4.0), io.quarkiverse.mockserver:quarkus-mockserver-examples-opentracing (0.2.1) +19 more potentially affected by CVE-2025-1634 via io.quarkus:quarkus-resteasy (2.10.2.final)

io.quarkus:quarkus-resteasy MAVEN version 2.10.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-resteasy and may be impacted: - com.radcortez.flyway:flyway-junit5-quarkus 1.4.0 -...

io.quarkiverse.jberet:quarkus-jberet-rest (>=1.2.1, <=1.2.2), io.quarkiverse.jberet:quarkus-jberet-rest-deployment (>=1.2.1, <=1.2.2) +19 more potentially affected by CVE-2025-1634 via io.quarkus:quarkus-resteasy (2.16.2.final)

io.quarkus:quarkus-resteasy MAVEN version 2.16.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-resteasy and may be impacted: - io.quarkiverse.jberet:quarkus-jberet-rest =1.2.1, =1.2.1, =1.2.2 -...

io.quarkus:quarkus-elytron-security (0.12.0), io.quarkus:quarkus-resteasy-jsonb (0.12.0) +4 more potentially affected by CVE-2025-1634 via io.quarkus:quarkus-resteasy (0.12.0)

io.quarkus:quarkus-resteasy MAVEN version 0.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-resteasy and may be impacted: - io.quarkus:quarkus-elytron-security 0.12.0 - io.quarkus:quarkus-resteasy-jsonb 0.12.0 -...

io.quarkus:quarkus-amazon-lambda (0.13.0), io.quarkus:quarkus-amazon-lambda-deployment (0.13.0) +8 more potentially affected by CVE-2025-1634 via io.quarkus:quarkus-resteasy (0.13.0)

io.quarkus:quarkus-resteasy MAVEN version 0.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-resteasy and may be impacted: - io.quarkus:quarkus-amazon-lambda 0.13.0 - io.quarkus:quarkus-amazon-lambda-deployment 0.13.0 -...

io.quarkus:quarkus-amazon-lambda (0.13.1), io.quarkus:quarkus-amazon-lambda-deployment (0.13.1) +8 more potentially affected by CVE-2025-1634 via io.quarkus:quarkus-resteasy (0.13.1)

io.quarkus:quarkus-resteasy MAVEN version 0.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-resteasy and may be impacted: - io.quarkus:quarkus-amazon-lambda 0.13.1 - io.quarkus:quarkus-amazon-lambda-deployment 0.13.1 -...

io.quarkus:quarkus-elytron-security-deployment (0.17.0), io.quarkus:quarkus-keycloak-deployment (0.17.0) +10 more potentially affected by CVE-2025-1634 via io.quarkus:quarkus-resteasy (0.17.0)

io.quarkus:quarkus-resteasy MAVEN version 0.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-resteasy and may be impacted: - io.quarkus:quarkus-elytron-security-deployment 0.17.0 - io.quarkus:quarkus-keycloak-deployment 0.17.0 -...

io.quarkiverse.cxf:quarkus-cxf-integration-test-client (>=1.5.15, <=1.5.17), io.quarkiverse.cxf:quarkus-cxf-integration-test-logging (>=1.5.15, <=1.5.17) +29 more potentially affected by CVE-2025-1634 via io.quarkus:quarkus-resteasy (2.13.8.final)

io.quarkus:quarkus-resteasy MAVEN version 2.13.8.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-resteasy and may be impacted: - io.quarkiverse.cxf:quarkus-cxf-integration-test-client =1.5.15, =1.5.15, =1.5.15, =1.5.15, =1.5.15...

io.quarkus:quarkus-resteasy-deployment (1.4.0.final), io.quarkus:quarkus-resteasy-jackson (1.4.0.final) +15 more potentially affected by CVE-2025-1634 via io.quarkus:quarkus-resteasy (1.4.0.final)

io.quarkus:quarkus-resteasy MAVEN version 1.4.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-resteasy and may be impacted: - io.quarkus:quarkus-resteasy-deployment 1.4.0.final - io.quarkus:quarkus-resteasy-jackson 1.4.0.fina...

io.quarkus:quarkus-elytron-security-deployment (0.18.0), io.quarkus:quarkus-keycloak-deployment (0.18.0) +16 more potentially affected by CVE-2025-1634 via io.quarkus:quarkus-resteasy (0.18.0)

io.quarkus:quarkus-resteasy MAVEN version 0.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-resteasy and may be impacted: - io.quarkus:quarkus-elytron-security-deployment 0.18.0 - io.quarkus:quarkus-keycloak-deployment 0.18.0 -...

io.quarkus:quarkus-kogito (1.3.1.final), io.quarkus:quarkus-kogito-deployment (1.3.1.final) +20 more potentially affected by CVE-2025-1634 via io.quarkus:quarkus-resteasy (1.3.1.final)

io.quarkus:quarkus-resteasy MAVEN version 1.3.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-resteasy and may be impacted: - io.quarkus:quarkus-kogito 1.3.1.final - io.quarkus:quarkus-kogito-deployment 1.3.1.final -...

io.quarkus:quarkus-kogito (0.28.0), io.quarkus:quarkus-kogito-deployment (0.28.0) +11 more potentially affected by CVE-2025-1634 via io.quarkus:quarkus-resteasy (0.28.0)

io.quarkus:quarkus-resteasy MAVEN version 0.28.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-resteasy and may be impacted: - io.quarkus:quarkus-kogito 0.28.0 - io.quarkus:quarkus-kogito-deployment 0.28.0 -...

io.quarkus:quarkus-kogito (0.28.1), io.quarkus:quarkus-kogito-deployment (0.28.1) +11 more potentially affected by CVE-2025-1634 via io.quarkus:quarkus-resteasy (0.28.1)

io.quarkus:quarkus-resteasy MAVEN version 0.28.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-resteasy and may be impacted: - io.quarkus:quarkus-kogito 0.28.1 - io.quarkus:quarkus-kogito-deployment 0.28.1 -...

io.quarkus.resteasy.reactive:resteasy-reactive-jackson (2.8.0.cr1), io.quarkus.resteasy.reactive:resteasy-reactive-jsonb (2.8.0.cr1) +53 more potentially affected by CVE-2024-1726 via io.quarkus.resteasy.reactive:resteasy-reactive (2.8.0.cr1)

io.quarkus.resteasy.reactive:resteasy-reactive MAVEN version 2.8.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.resteasy.reactive:resteasy-reactive and may be impacted: - io.quarkus.resteasy.reactive:resteasy-reactive-jackson 2.8.0.cr...

io.quarkus.resteasy.reactive:resteasy-reactive-jackson (3.8.0.cr1), io.quarkus.resteasy.reactive:resteasy-reactive-jsonb (3.8.0.cr1) +58 more potentially affected by CVE-2024-1726 via io.quarkus.resteasy.reactive:resteasy-reactive (3.8.0.cr1)

io.quarkus.resteasy.reactive:resteasy-reactive MAVEN version 3.8.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.resteasy.reactive:resteasy-reactive and may be impacted: - io.quarkus.resteasy.reactive:resteasy-reactive-jackson 3.8.0.cr...