CVE-2026-58041: node:sqlite SQLTagStore Iterator Replay Lets Attacker Re-Execute Victim-Bound Writes Indefinitely
A flaw in node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3reset() directly, bypassing the iterator invalidation mechanism introduced for StatementSync in recent releases.
Other sources
A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3reset() directly, bypassing the iterator invalidation mechanism introduced for StatementSync in recent releases
This vulnerability affects Node.js 22.x, 24.x, and 26.x.
— Node.Js
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.18.1Fixed in 26.5.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.18.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26.5.1 - Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 24.18.1-r0 - Upgrade
Upgrade
alpine/nodejs-currentto a version that resolves this vulnerability.Fixed in 26.5.1-r0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2026-58041?
The severity of CVE-2026-58041 is classified as medium with a score of 5.3.
How do I fix CVE-2026-58041?
To fix CVE-2026-58041, ensure you are using the updated versions of Node.js and the node:sqlite package that address this vulnerability.
What kind of vulnerability is CVE-2026-58041?
CVE-2026-58041 is classified as a SQL Injection vulnerability.
What software is affected by CVE-2026-58041?
CVE-2026-58041 affects the npm/node:sqlite package and OpenJS Foundation Node.js.
What does CVE-2026-58041 allow an attacker to do?
CVE-2026-58041 allows an attacker to execute a stale StatementSyncIterator, potentially leading to unintended behavior or exposure of data.