Node.js up to 22.23.0/24.17.x/26.4.x StatementSyncIterator DatabaseSync#createTagStore sql injection

Summaryinfo

A vulnerability identified as critical has been detected in Node.js up to 22.23.0/24.17.x/26.4.x. Affected by this vulnerability is the function DatabaseSync#createTagStore of the component StatementSyncIterator. Performing a manipulation results in sql injection. This vulnerability is reported as CVE-2026-58041. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Node.js up to 22.23.0/24.17.x/26.4.x. It has been classified as critical. This affects the function DatabaseSync#createTagStore of the component StatementSyncIterator. The manipulation with an unknown input leads to a sql injection vulnerability. CWE is classifying the issue as CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3_reset() directly, bypassing the iterator invalidation mechanism introduced for StatementSync in recent releases This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.

The advisory is shared at nodejs.org. This vulnerability is uniquely identified as CVE-2026-58041 since 06/27/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1505 for this issue.

Upgrading to version 22.23.1, 24.18.0 or 26.5.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-52561). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• JavaScript Library

Name

• Node.js

Version

• 22.0
• 22.1
• 22.2
• 22.3
• 22.4
• 22.5
• 22.6
• 22.7
• 22.8
• 22.9
• 22.10
• 22.11
• 22.12
• 22.13
• 22.14
• 22.15
• 22.16
• 22.17
• 22.18
• 22.19
• 22.20
• 22.21
• 22.22
• 22.23.0
• 24.0
• 24.1
• 24.2
• 24.3
• 24.4
• 24.5
• 24.6
• 24.7
• 24.8
• 24.9
• 24.10
• 24.11
• 24.12
• 24.13
• 24.14
• 24.15
• 24.16
• 24.17
• 26.0
• 26.1
• 26.2
• 26.3
• 26.4

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion