HIGH

GHSA-rfh2-8vxq-jqr8

NodeBB SQL Injection vulnerability

Details

NodeBB v4.3.0 is vulnerable to SQL injection in its search-categories API endpoint (/api/v3/search/categories). The search query parameter is not properly sanitized, allowing unauthenticated, remote attackers to inject boolean-based blind and PostgreSQL error-based payloads.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/nodebb

Introduced in: 0

No fixed version published yet for nodebb (npm). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-50979[ADVISORY]
https://github.com/4rdr/proofs/blob/main/info/NodeBB-v4.3.0.-SQL-Injection-via-search-parameter.md[WEB]
https://github.com/NodeBB/NodeBB[PACKAGE]