mikro-orm @mikro-orm/core vulnerabilities

Latest mikro-orm @mikro-orm/core CVEs

Newest publication first

1. CVE-2026-34220 MikroORM is vulnerable to SQL Injection via specially crafted object

   Published 2026-03-31

   Critical·CVSS 9.3 EPSS 0.43%

   MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to versions 6.6.10 and 7.0.6, there is a SQL injection vulnerability when specially crafted objects are interpreted as raw SQL query fragments. This issue has been patched...

2. CVE-2026-34221 MikroORM has Prototype Pollution in Utils.merge

   Published 2026-03-31

   High·CVSS 8.3 EPSS 0.38%

   MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to versions 6.6.10 and 7.0.6, a prototype pollution vulnerability exists in the Utils.merge helper used internally by MikroORM when merging object structures. The function...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.