CVE-2026-58041 Overview
CVE-2026-58041 affects the node:sqlite module in Node.js versions 22.x, 24.x, and 26.x. The flaw allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3_reset() directly, bypassing the iterator invalidation mechanism introduced for StatementSync in recent releases. The issue is classified as a time-of-check time-of-use flaw [CWE-367].
Critical Impact
Applications relying on node:sqlite tag stores can return or process query results derived from unintended parameters, undermining data integrity.
Affected Products
- Node.js 22.x
- Node.js 24.x
- Node.js 26.x
Discovery Timeline
- 2026-08-04 - CVE-2026-58041 published to NVD
- 2026-08-04 - Last updated in NVD database
Technical Details for CVE-2026-58041
Vulnerability Analysis
The vulnerability lives in Node.js's built-in SQLite binding. DatabaseSync#createTagStore() returns tagged-template helpers backed by cached prepared statements. When a caller invokes a tag store method, SQLTagStore calls sqlite3_reset() on the cached statement and rebinds new parameters for reuse.
An earlier StatementSyncIterator created against the same statement remains alive after this reset. Recent Node.js releases added an invalidation mechanism for StatementSync, but SQLTagStore bypasses that mechanism by resetting the underlying statement directly. The stale iterator can then continue iterating the reset statement, executing queries with parameters intended for a different call site.
Root Cause
The root cause is a time-of-check to time-of-use condition [CWE-367] between iterator creation and statement reuse. SQLTagStore resets and rebinds a statement without notifying the outstanding iterator that its underlying resource has been mutated. Because the check that validates iterator liveness occurs before the reset performed by SQLTagStore, subsequent .next() calls execute against a rebound statement rather than the original query context.
Attack Vector
Exploitation requires user interaction and specific application patterns that expose tagged template query builders backed by createTagStore(). An attacker who can influence the sequencing of tag store calls, or supply inputs that trigger a rebind while an iterator is still consumed, can cause the application to return or act on data bound to different parameters. The impact is scoped to integrity rather than confidentiality or availability, based on the CVSS vector.
The vulnerability is described in prose only; no verified public exploit code is available. Refer to the Node.js Security Blog Post for maintainer-supplied technical detail.
Detection Methods for CVE-2026-58041
Indicators of Compromise
- Unexpected result rows returned from code paths using DatabaseSync#createTagStore() that do not match the parameters logged at the call site.
- Application logs showing interleaved tag store queries where iterator consumption spans multiple rebinds of the same cached statement.
Detection Strategies
- Inventory Node.js runtimes across production, build, and container images to identify versions in the 22.x, 24.x, and 26.x branches using node:sqlite.
- Audit source code for use of DatabaseSync, createTagStore, and StatementSyncIterator to locate code paths where iterators may outlive a reset.
- Add integration tests that assert query results match bound parameters when tag store statements are reused across concurrent async contexts.
Monitoring Recommendations
- Log parameter bindings alongside result set checksums for SQLite queries issued through tag stores and compare against expected values.
- Alert on anomalous data returned to callers of tag-store-backed APIs, particularly when identifiers in results do not match request context.
How to Mitigate CVE-2026-58041
Immediate Actions Required
- Upgrade Node.js to the fixed release in the 22.x, 24.x, and 26.x branches as documented in the Node.js Security Blog Post.
- Rebuild and redeploy container images and serverless functions pinned to affected Node.js versions.
- Review application code that consumes StatementSyncIterator results asynchronously and ensure iterators are fully drained before the statement is reused.
Patch Information
Node.js maintainers addressed the flaw in the July 2026 security releases for the 22.x, 24.x, and 26.x lines. Consult the Node.js Security Blog Post for exact fixed version numbers and upgrade guidance.
Workarounds
- Avoid DatabaseSync#createTagStore() in favor of prepared statements managed directly through StatementSync, which honors the iterator invalidation mechanism.
- Ensure any StatementSyncIterator is fully consumed or explicitly closed before issuing another tag store call that would reset the cached statement.
# Verify installed Node.js version and upgrade path
node --version
nvm install --lts
nvm alias default lts/*
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
