CVE-2026-58045 Overview
CVE-2026-58045 is a denial of service vulnerability in Node.js affecting the synchronous node:zlib API surface. A spoofed TypedArraybyteLength value triggers a reachable assertion inside the runtime, forcing the entire Node.js process to crash. All 11 synchronous zlib functions are affected, giving attackers multiple entry points to reach the vulnerable code path. The flaw is tracked as an uncontrolled resource consumption weakness [CWE-400]. Affected release lines include Node.js 22.x, 24.x, and 26.x. Repeated exploitation produces a sustained denial of service against any service that processes attacker-influenced buffers through synchronous zlib calls.
Critical Impact
An attacker who can supply a crafted TypedArray to a synchronous zlib function crashes the Node.js process, and repeated invocation yields a persistent denial of service condition.
Affected Products
- Node.js 22.x
- Node.js 24.x
- Node.js 26.x
Discovery Timeline
- 2026-08-04 - CVE-2026-58045 published to the National Vulnerability Database (NVD)
- 2026-08-04 - Last updated in NVD database
Technical Details for CVE-2026-58045
Vulnerability Analysis
The vulnerability lives in the synchronous portion of the node:zlib module. Node.js exposes 11 synchronous compression and decompression functions, including deflateSync, inflateSync, gzipSync, gunzipSync, brotliCompressSync, and brotliDecompressSync. Each of these accepts a TypedArray or Buffer as input. When the runtime receives a TypedArray whose byteLength property has been spoofed to disagree with the underlying ArrayBuffer, an internal invariant check fails. The failure surfaces as a reachable assertion inside the native binding rather than a JavaScript-level exception. Because the assertion is fatal, the process terminates immediately without an opportunity for user code to catch or recover. Consult the Node.js July 2026 Security Releases advisory for the full technical description.
Root Cause
The root cause is missing validation of TypedArray metadata before the buffer is passed into native zlib routines. The runtime trusts the byteLength property returned by the view instead of reconciling it with the backing ArrayBuffer. When these values disagree, the native code hits an assertion path intended to catch internal state corruption. That path was reachable from user-supplied input, converting a defensive check into a denial of service primitive [CWE-400].
Attack Vector
Exploitation requires local access to code paths that feed input into a synchronous zlib function. An attacker constructs a TypedArray and overrides or corrupts its byteLength accessor, then passes the object to any of the 11 synchronous zlib APIs. The call reaches the native layer, the assertion fires, and the Node.js process exits. In server contexts where the same process handles multiple requests, this terminates all in-flight work. Repeated submissions to a restart loop produce sustained unavailability.
No verified public exploit code is available. Refer to the vendor advisory for technical specifics on the assertion path and the affected function list.
Detection Methods for CVE-2026-58045
Indicators of Compromise
- Unexpected Node.js process exits with assertion failure messages referencing node:zlib or TypedArraybyteLength in stderr or crash logs.
- Repeated process restarts by supervisors such as systemd, pm2, or Kubernetes liveness probes shortly after requests containing compressed payloads.
- Spikes in 5xx responses correlated with input processed by deflateSync, inflateSync, gzipSync, gunzipSync, or Brotli synchronous variants.
Detection Strategies
- Audit application code for synchronous node:zlib calls that operate on request-derived buffers, and flag call sites lacking explicit Buffer.isBuffer or length validation.
- Correlate process crash telemetry with request logs to identify payloads that consistently precede termination.
- Monitor container and pod restart counts for Node.js workloads that expose compression endpoints.
Monitoring Recommendations
- Forward Node.js stderr and crash artifacts to a centralized logging pipeline for assertion-string matching.
- Track EPSS movement for CVE-2026-58045, currently reported at 0.189% with a low percentile, to detect shifts in exploit likelihood.
- Alert on abnormal process exit codes from Node.js services that accept user-supplied binary data.
How to Mitigate CVE-2026-58045
Immediate Actions Required
- Upgrade to the patched Node.js releases published in the Node.js July 2026 Security Releases advisory for the 22.x, 24.x, and 26.x lines.
- Inventory all services using node:zlib synchronous APIs on request-derived data and prioritize their patching.
- Restart long-running Node.js processes after upgrading to ensure the patched binaries are loaded.
Patch Information
The Node.js project addressed CVE-2026-58045 in the July 2026 security releases spanning the 22.x, 24.x, and 26.x lines. Apply the vendor-supplied builds and rebuild any container images that bundle Node.js. Downstream distributions and managed runtimes should be updated once they incorporate the upstream fixes.
Workarounds
- Replace synchronous zlib calls with their asynchronous counterparts where feasible, since only the synchronous functions are documented as affected.
- Convert untrusted input to a fresh Buffer using Buffer.from(input) before passing it to zlib functions, which normalizes the backing storage and length.
- Reject requests whose declared content length disagrees with the received payload size at the framework or reverse-proxy layer.
# Verify the running Node.js version against the patched release lines
node --version
# Example npm engines constraint to enforce a patched runtime
# Update the minimum versions to the fixed releases from the vendor advisory
npm pkg set engines.node=">=22.x <23 || >=24.x <25 || >=26.x"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
