Node.js node:sqlite Stale SI Reuses Cached PreStmt
CVE-2026-58041 Published on August 4, 2026
A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3_reset() directly, bypassing the iterator invalidation mechanism introduced for StatementSync in recent releases This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.
Weakness Type
What is a TOCTTOU Vulnerability?
The software checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the software to perform invalid actions when the resource is in an unexpected state. This weakness can be security-relevant when an attacker can influence the state of the resource between check and use. This can happen with shared resources such as files, memory, or even variables in multithreaded programs.
CVE-2026-58041 has been classified to as a TOCTTOU vulnerability or weakness.
Affected Versions
nodejs node:- Version 22.23.1, <= 22.23.1 is affected.
- Version 24.18.0, <= 24.18.0 is affected.
- Version 26.5.0, <= 26.5.0 is affected.