CVE-2026-34220: Mikro-Orm Mikroorm

Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days.

MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to versions 6.6.10 and 7.0.6, there is a SQL injection vulnerability when specially crafted objects are interpreted as raw SQL query fragments. This issue has been patched in versions 6.6.10 and 7.0.6.

Affected products

• Mikro-Orm Mikroorm: before 6.6.10 (fixed in 6.6.10); from 7.0.0, before 7.0.6 (fixed in 7.0.6)

Published 2026-03-31. Last modified 2026-07-24.