CVE-2026-58041: 
Node.js Schwachstellenanalyse und -minderung

CVE-2026-58041 is a Medium-severity vulnerability in the node:sqlite component of Node.js, specifically in the SQLTagStore iterator mechanism. A stale StatementSyncIterator created via DatabaseSync#createTagStore() can continue executing a cached prepared statement after it has been reset and rebound with new parameters, potentially leading to unintended re-execution of write operations. The vulnerability affects Node.js release lines 24.x and 26.x. It was disclosed on July 29, 2026, as part of the Node.js July 2026 security release, and is estimated to be HIGH severity by Feedly (Node.js Advisory).

SQLTagStore resets cached prepared statements using sqlite3_reset() directly, bypassing the iterator invalidation mechanism that was introduced for StatementSync in recent Node.js releases (CWE classification not yet formally assigned). When a statement is reset and rebound with new parameters, a previously created StatementSyncIterator remains valid and can replay the cached statement, potentially re-executing write operations with stale or incorrect context. Exploitation requires the ability to interact with the node:sqlite API, meaning it is primarily a concern for applications that expose DatabaseSync#createTagStore() functionality to untrusted input or logic paths (Node.js Advisory).

Successful exploitation could allow an attacker or malicious code path to cause unintended SQL write operations to be re-executed against a SQLite database, potentially leading to data corruption, unauthorized data modification, or integrity violations. The impact is limited to applications using the node:sqlite module with DatabaseSync#createTagStore(), and does not directly enable remote code execution or privilege escalation. The vulnerability affects confidentiality and integrity of the SQLite database managed by the affected Node.js process (Node.js Advisory).

Node.js has released patched versions addressing CVE-2026-58041: v24.18.1 and v26.5.1, both released on July 29, 2026. Users running affected Node.js 24.x or 26.x versions who use the node:sqlite module should upgrade to these patched releases immediately. No configuration-based workaround has been published; upgrading is the recommended remediation (Node.js Advisory, Node.js v24.18.1, Node.js v26.5.1).

The vulnerability was covered by cybersecurity news outlets as part of broader reporting on the Node.js July 2026 security release, which addressed 11 security flaws in total. Coverage highlighted the range of severity levels and the variety of affected components (CyberSecurityNews, Cryptika).