Loading vulnerability…
Node.js synchronous zlib reachable assertion denial of service
CVE-2026-58045 is a reachable assertion vulnerability in Node.js synchronous zlib APIs. A TypedArray with a spoofed byteLength can trigger an assertion failure that terminates the entire Node.js process. All 11 synchronous zlib functions are affected in vulnerable releases of the Node.js 22.x, 24.x, and 26.x branches.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation crashes the entire Node.js process, interrupting all application functionality hosted by that process. Repeated triggering can cause sustained denial of service. No confidentiality or integrity impact is identified.
If you can’t patch tonight, do this now.
Until patched, prevent attacker-controlled JavaScript or TypedArray objects from reaching synchronous zlib APIs where feasible. Process supervision, rate limiting, and service redundancy can reduce disruption but do not eliminate the assertion failure. No specific vendor workaround is established.
Patch, then assume compromise.
Upgrade Node.js to 22.23.2, 24.18.1, or 26.5.1, or a later fixed release in the applicable branch. For distribution-managed installations, install the corresponding vendor-fixed packages; Alpine nodejs-current is fixed in 26.5.1-r0 or later. Update bundled Node.js runtimes through the applicable product or buildpack security release.
No validated public exploits yet. Hidden: 3 rejected by Mallory's analysis as not a working exploit.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.