CVE-2025-50979: NodeBB SQL Injection vulnerability

August 27, 2025 (updated November 10, 2025)

NodeBB v4.3.0 is vulnerable to SQL injection in its search-categories API endpoint (/api/v3/search/categories). The search query parameter is not properly sanitized, allowing unauthenticated, remote attackers to inject boolean-based blind and PostgreSQL error-based payloads.

References

github.com/4rdr/proofs/blob/main/info/NodeBB-v4.3.0.-SQL-Injection-via-search-parameter.md
github.com/NodeBB/NodeBB
github.com/advisories/GHSA-rfh2-8vxq-jqr8
nvd.nist.gov/vuln/detail/CVE-2025-50979

Code Behaviors & Features

Detect and mitigate CVE-2025-50979 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →