CVE-2026-58041: SQL Injection

Q: What is the severity of CVE-2026-58041?

The severity of CVE-2026-58041 is classified as medium with a score of 5.3.

Q: How do I fix CVE-2026-58041?

To fix CVE-2026-58041, ensure you are using the updated versions of Node.js and the node:sqlite package that address this vulnerability.

Q: What kind of vulnerability is CVE-2026-58041?

CVE-2026-58041 is classified as a SQL Injection vulnerability.

Q: What software is affected by CVE-2026-58041?

CVE-2026-58041 affects the npm/node:sqlite package and OpenJS Foundation Node.js.

Q: What does CVE-2026-58041 allow an attacker to do?

CVE-2026-58041 allows an attacker to execute a stale StatementSyncIterator, potentially leading to unintended behavior or exposure of data.

Published Aug 4, 2026

Updated

A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3reset() directly, bypassing the iterator invalidation mechanism introduced for StatementSync in recent releases This vulnerability affects Node.js 22.x, 24.x, and 26.x.

Affected Software

2 affected components

npm/node:sqlite

OpenJS Foundation Node.js>=22.0.0<=22.x, >=24.0.0<=24.x, >=26.0.0<=26.x

Event History

Aug 4, 2026

CVE Published

via MITRE·12:49 AM

Data Sourced

via MITRE·12:49 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-58041?

The severity of CVE-2026-58041 is classified as medium with a score of 5.3.

How do I fix CVE-2026-58041?

To fix CVE-2026-58041, ensure you are using the updated versions of Node.js and the node:sqlite package that address this vulnerability.

What kind of vulnerability is CVE-2026-58041?

CVE-2026-58041 is classified as a SQL Injection vulnerability.

What software is affected by CVE-2026-58041?

CVE-2026-58041 affects the npm/node:sqlite package and OpenJS Foundation Node.js.

What does CVE-2026-58041 allow an attacker to do?

CVE-2026-58041 allows an attacker to execute a stale StatementSyncIterator, potentially leading to unintended behavior or exposure of data.

CVE-2026-58041: SQL Injection

Affected Software

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2026-58041?

How do I fix CVE-2026-58041?

What kind of vulnerability is CVE-2026-58041?

What software is affected by CVE-2026-58041?

What does CVE-2026-58041 allow an attacker to do?

Company

Resources

Contact

Frequently Asked Questions

What is the severity of CVE-2026-58041?

How do I fix CVE-2026-58041?

What kind of vulnerability is CVE-2026-58041?

What software is affected by CVE-2026-58041?

What does CVE-2026-58041 allow an attacker to do?