Is sequelize safe to use?

sequelize has 2 known vulnerabilities on the latest version (6.37.8). DepScope rates its health at 78/100 (moderate risk).

What is the latest version of sequelize?

The latest version of sequelize is 6.37.8, released 2026-03-07.

Does sequelize have known vulnerabilities?

Yes. sequelize has 2 known vulnerabilities. See depscope.dev/pkg/npm/sequelize for details.

Is sequelize deprecated?

No, sequelize is actively maintained. Latest release: 6.37.8 (2026-03-07).

What are alternatives to sequelize?

Popular alternatives to sequelize in npm include: debug, lru-cache, string-width, commander, picomatch.

What license does sequelize use?

sequelize is licensed under MIT.

sequelize

npmv6.37.8

Sequelize is a promise-based Node.js ORM tool for Postgres, MySQL, MariaDB, SQLite, Microsoft SQL Server, Amazon Redshift and Snowflake’s Data Cloud. It features solid transaction support, relations, eager and lazy loading, read replication and more.

License MITpermissive627 versions9 maintainers16 deps2,851,106 weekly dl

sequelize/sequelize

/ 100

Health

do not use

sequelize has critical vulnerabilities — do not use

Update to >= 7.0.0-alpha.20 to fix known vulnerabilities

1 critical vulnerabilities

Health breakdown0 – 100

20/25

maintenance

17/20

popularity

13/25

security

15/15

maturity

13/15

community

Vulnerabilities

1 critical1 medium

Advisories (2)

Severity	ID	Summary	Fixed in
medium	CVE-2023-22580	Sequelize information disclosure vulnerability	7.0.0-alpha.20
critical	CVE-2023-22579	Unsafe fall-through in getWhereConditions	7.0.0-alpha.20

Bundle & TypeScript

📦

Bundle Size

1364.2 KBminified

216.3 KB gzipped

16 direct dependencies

side effects

🌟

TypeScript

10/10typed

bundled

Health History

Dependency Tree

License Audit

Dependencies (16)

@types/debug @types/validator debug dottie inflection lodash moment moment-timezone pg-connection-string retry-as-promised semver sequelize-pool toposort-class uuid validator wkx

API access

Get this data programmatically — free, no authentication.

curl https://depscope.dev/api/check/npm/sequelize