CVE-2026-58041

Name of the Vulnerable Software and Affected Versions Node.js versions 22.x Node.js versions 24.x Node.js versions 26.x

Description A flaw in the node:sqlite module allows a stale StatementSyncIterator created via the DatabaseSync#createTagStore() function to continue executing a cached prepared statement after it has been reset and rebound with new parameters. This occurs because SQLTagStore resets cached statements using sqlite3 reset() directly, which bypasses the iterator invalidation mechanism designed for StatementSync in recent releases.

Recommendations Update Node.js 22.x to the latest patched version. Update Node.js 24.x to version 24.18.1-1.1 or newer. Update Node.js 26.x to version 26.5.1-1.1 or newer.