Vulnerability in Node.js Node
CVE-2026-58041
A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3_reset() directly, bypassing the iterator invalidation mechanism introduced for StatementSync in recent releases
This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.
Vulnerability class: TOCTOU (Time-of-Check to Time-of-Use)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N.
EPSS exploit prediction
EPSS 0.003, 21.4th percentile (scored ); unchanged over 30 days. About EPSS.
Affected products
- Node.js Node — versions 22.23.1, 24.18.0, 26.5.0
Weakness classification (CWE)
Public exploits and proof-of-concept code
5 public repositories with exploit or proof-of-concept code for this CVE:
- CompleTech-Security/node-cve-2026-58041-check (last pushed 2026-10-26): Offline Node.js evidence checker for CVE-2026-58041: SQLite cached iterator write replay. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
- CompleteTech-Security/node-cve-2026-58041-check (last pushed 2026-10-26): Offline Node.js evidence checker for CVE-2026-58041: SQLite cached iterator write replay. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
- CompleTetech-Security/node-cve-2026-58041-check (last pushed 2026-10-26): Offline Node.js evidence checker for CVE-2026-58041: SQLite cached iterator write replay. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
- completetech-security/node-cve-2026-58041-check (last pushed 2026-10-24): Standalone defensive checker project for CVE-2026-58041: Node.js: SQLite cached iterator write replay. One exploit per repository; implementation pending.
- CompleteTech-LLC/node-cve-2026-58041-check (last pushed 2026-10-24): Standalone defensive checker project for CVE-2026-58041: Node.js: SQLite cached iterator write replay. One exploit per repository; implementation pending.
References
This CVE has public exploit evidence. See the latest CVEs with public exploits.