CVE-2026-58041: SQL Injection
A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3reset() directly, bypassing the iterator invalidation mechanism introduced for StatementSync in recent releases This vulnerability affects Node.js 22.x, 24.x, and 26.x.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58041?
The severity of CVE-2026-58041 is classified as medium with a score of 5.3.
How do I fix CVE-2026-58041?
To fix CVE-2026-58041, ensure you are using the updated versions of Node.js and the node:sqlite package that address this vulnerability.
What kind of vulnerability is CVE-2026-58041?
CVE-2026-58041 is classified as a SQL Injection vulnerability.
What software is affected by CVE-2026-58041?
CVE-2026-58041 affects the npm/node:sqlite package and OpenJS Foundation Node.js.
What does CVE-2026-58041 allow an attacker to do?
CVE-2026-58041 allows an attacker to execute a stale StatementSyncIterator, potentially leading to unintended behavior or exposure of data.