CVE-2026-58041 PUBLISHED

Assigner: hackerone
Reserved: 27.06.2026 Published: 04.08.2026 Updated: 04.08.2026

A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3_reset() directly, bypassing the iterator invalidation mechanism introduced for StatementSync in recent releases

This vulnerability affects Node.js 22.x, 24.x, and 26.x.

Metrics

CVSS 3.0

CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS Score: 5.3

Attack Vector	Network	Scope	Unchanged
Attack Complexity	High	Confidentiality Impact	None
Privileges Required	None	Integrity Impact	High
User Interaction	Required	Availability Impact	None

CVSS 3.0

Product Status

Vendor	nodejs
Product	node
Versions	Default: unaffected affected from 22.23.1 to 22.23.1 (incl.) affected from 24.18.0 to 24.18.0 (incl.) affected from 26.5.0 to 26.5.0 (incl.)

References

https://nodejs.org/en/blog/vulnerability/july-2026-security-releases

Problem Types

CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition CWE