Loading vulnerability…
SQLite write re-execution via stale iterators in Node.js
CVE-2026-58041 is a statement lifecycle flaw in Node.js node:sqlite affecting the 22.x, 24.x, and 26.x release lines. A stale StatementSyncIterator created through DatabaseSync#createTagStore() can continue executing a cached prepared statement after that statement has been reset and rebound with new parameters. SQLTagStore calls sqlite3_reset() directly, bypassing the StatementSync iterator invalidation mechanism. Resuming the stale iterator can therefore execute the statement using parameters from a subsequent operation, potentially causing unintended database modifications.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise database integrity through unintended SQL write re-execution with newly bound parameters. Depending on the statement and application behavior, unintended query execution may also expose data. The affected operations remain subject to the database access available to the application; arbitrary code execution or broader system compromise is not established.
If you can’t patch tonight, do this now.
Until an upgrade is deployed, avoid retaining or consuming StatementSyncIterator instances after any operation that could cause the associated SQLTagStore cached statement to be reused, reset, or rebound. Constrain access to database operations and validate application behavior for iterator reuse across concurrent or sequential request contexts.
Patch, then assume compromise.
Upgrade Node.js to version 22.23.2, 24.18.1, or 26.5.1, according to the deployed release line, or a later patched release. For Alpine Linux nodejs-current installations, upgrade to package version 26.5.1-r0 or later. Applications using a bundled Node.js runtime must update the containing package or buildpack to a release incorporating the fix.
No validated public exploits yet. Hidden: 3 rejected by Mallory's analysis as not a working exploit.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.