Node.js SQLite Vulnerability Affecting Multiple Versions of Node.js

CVE-2026-58041

What is CVE-2026-58041?

A vulnerability exists within Node.js's implementation of SQLite where a stale StatementSyncIterator is allowed to continue executing a cached prepared statement after it has been reset and rebound with new parameters. This flaw arises from a deficiency in the iterator invalidation mechanism which is designed to prevent such issues. As a result, it can present significant security concerns in scenarios where sensitive data is being accessed or manipulated through database operations. This affects several versions of Node.js, highlighting the importance of applying proper database handling practices.

References