What is CVE-2026-58041?

CVE-2026-58041 is a medium-severity vulnerability in Node.js Node, classified under Time-of-check Time-of-use (TOCTOU) Race Condition. CVSS score: 5.3/10. Published 2026-08-04.

How severe is CVE-2026-58041?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Node.js Node

CVE-2026-58041

A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3_reset() directly, bypassing the iterator invalidation mechanism introduced for StatementSync in recent releases This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.

Vulnerability class: TOCTOU (Time-of-Check to Time-of-Use)

EPSS: 0.003 (17.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N.

Affected products

Nodejs Node — versions 22.23.1, 24.18.0, 26.5.0

Weakness classification (CWE)

CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition

References

support@hackerone.com

Frequently asked questions

What is CVE-2026-58041?: CVE-2026-58041 is a medium-severity vulnerability in Node.js Node, classified under Time-of-check Time-of-use (TOCTOU) Race Condition. CVSS score: 5.3/10. Published 2026-08-04.
How severe is CVE-2026-58041?: Medium severity. CVSS v3 base score is 5.3 out of 10.