CVE-2026-58045: Reachable assertion in node:zlib sync API crashes the entire process via spoofed TypedArray byteLength (all 11 *Sync functions affected)
A flaw in Node.js allows a spoofed TypedArray byteLength to trigger a reachable assertion in the synchronous node:zlib APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected.
Repeated exploitation of this condition can result in a denial of service.
This vulnerability affects Node.js 22.x, 24.x, and 26.x.
Other sources
A flaw in Node.js allows a spoofed TypedArray byteLength to trigger a reachable assertion in the synchronous node:zlib APIs, causing the process to crash.
Repeated exploitation of this condition can result in a denial of service.
— Node.Js
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.23.2Fixed in 24.18.1Fixed in 26.5.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.23.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.18.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26.5.1 - Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 22.23.2-r0 - Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 24.18.1-r0 - Upgrade
Upgrade
alpine/nodejs-currentto a version that resolves this vulnerability.Fixed in 26.5.1-r0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2026-58045?
The severity of CVE-2026-58045 is medium with a score of 6.2.
How do I fix CVE-2026-58045?
To fix CVE-2026-58045, update your Node.js version to the latest security release that addresses this vulnerability.
What are the potential impacts of CVE-2026-58045?
CVE-2026-58045 can lead to denial of service by causing the Node.js process to crash when exploited.
Which Node.js features are affected by CVE-2026-58045?
CVE-2026-58045 affects all 11 synchronous zlib functions in Node.js.
Is CVE-2026-58045 a remote or local vulnerability?
CVE-2026-58045 is a local vulnerability since it requires an attacker to have access to the Node.js application environment.