Node.js up to 22.23.0/24.17.x/26.4.x StatementSyncIterator DatabaseSync#createTagStore sql injection

Summaryinfo

A vulnerability identified as critical has been detected in Node.js up to 22.23.0/24.17.x/26.4.x. Affected by this vulnerability is the function DatabaseSync#createTagStore of the component StatementSyncIterator. Performing a manipulation results in sql injection. This vulnerability is reported as CVE-2026-58041. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Node.js up to 22.23.0/24.17.x/26.4.x. It has been classified as critical. This affects the function DatabaseSync#createTagStore of the component StatementSyncIterator. The manipulation with an unknown input leads to a sql injection vulnerability. CWE is classifying the issue as CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3_reset() directly, bypassing the iterator invalidation mechanism introduced for StatementSync in recent releases This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.

The advisory is shared at nodejs.org. This vulnerability is uniquely identified as CVE-2026-58041 since 06/27/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1505 for this issue.

Upgrading to version 22.23.1, 24.18.0 or 26.5.0 eliminates this vulnerability.

The vulnerability is also documented in the databases at CNNVD (CNNVD-2026-86401501) and EUVD (EUVD-2026-52561). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• JavaScript Library

Name

• Node.js

Version

• 22.0
• 22.1
• 22.2
• 22.3
• 22.4
• 22.5
• 22.6
• 22.7
• 22.8
• 22.9
• 22.10
• 22.11
• 22.12
• 22.13
• 22.14
• 22.15
• 22.16
• 22.17
• 22.18
• 22.19
• 22.20
• 22.21
• 22.22
• 22.23.0
• 24.0
• 24.1
• 24.2
• 24.3
• 24.4
• 24.5
• 24.6
• 24.7
• 24.8
• 24.9
• 24.10
• 24.11
• 24.12
• 24.13
• 24.14
• 24.15
• 24.16
• 24.17
• 26.0
• 26.1
• 26.2
• 26.3
• 26.4

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion