Quick answers
- Is CVE-2025-50979 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-50979 being exploited in the wild.
- How severe is CVE-2025-50979?
- Medium severity, with a CVSS score of 4, published 27 August 2025.
- Which products and versions are affected?
- NodeBB 4.3.0 and earlier.
- Is there a fix for CVE-2025-50979?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2025-50979 attacked?
- It is attacked over the network.
- Am I affected by CVE-2025-50979?
- Check whether you run NodeBB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
NodeBB v4.3.0 contains a SQL injection vulnerability in the /api/v3/search/categories API endpoint where the search query parameter is not properly sanitized before being used in SQL queries. The vulnerability allows unauthenticated remote attackers to inject boolean-based blind and PostgreSQL error-based SQL payloads. No authentication or user interaction is required; the endpoint is directly exploitable via HTTP requests. An attacker can extract sensitive database information, modify or delete records, and potentially escalate privileges depending on database permissions. A patch addressing the input sanitization issue is recommended.
Affected products
- NodeBB NodeBB 4.3.0 and earlier
Identifiers
- CVE-2025-50979
- GHSA-rfh2-8vxq-jqr8
Timeline
- 2025-08-27: disclosed: Vulnerability published to GitHub advisory database