Packages

knex

3.3.0 · 26 Jun 2026MIT3M / weekRepositoryHomepagenpmAtom feed

Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

Is your project affected?

Paste your package.json, or type the range you declare for knex. It is read in your browser and sent nowhere.

LineNewestWhere it stands
3.3.0No known advisory
2.5.141 open advisories, worst critical · last release Jul 2023, no longer updated
  • Critical
    SQL Injection in knexGHSA-58v4-qwx5-7f59 · 21 Oct 2019
    • 0.19.x0.19.0 – 0.19.4Fixed in 0.19.5
    • 0.18.x and older0.0.0 – 0.18.4No fix, no longer updated · move to 0.19.5
  • High
    Knex.js has a limited SQL injection vulnerabilityGHSA-4jv9-3563-23j3 · 19 Dec 2022
    • 2.x2.0.0 – 2.3.0Fixed in 2.4.0
    • 1.x and older0.0.0 – 1.0.7No fix, no longer updated · move to 2.4.0

Quality and security signals

What npm and deps.dev say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 21 Oct 2026. Releases and advisories last read 21 Oct 2026.