A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3 reset() directly, bypassing the iterator invalidation mechanism introduced for StatementSync in recent releases

This vulnerability affects Node.js 22.x, 24.x, and 26.x.