CVE-2026-58041: 
npm vulnerability analysis and mitigation

CVE-2026-58041 is a statement cache invalidation flaw in Node.js's built-in node:sqlite module, classified as "node:sqlite SQLTagStore iterator replay can re-execute writes." A stale StatementSyncIterator created via DatabaseSync#createTagStore() can continue executing a cached prepared statement after it has been reset and rebound with new parameters, because SQLTagStore calls sqlite3_reset() directly and bypasses the iterator invalidation mechanism introduced for StatementSync. The vulnerability affects Node.js 22.x, 24.x, and 26.x (specifically up to and including versions 22.23.1, 24.18.0, and 26.5.0). It was disclosed on July 29, 2026 as part of the Node.js July 2026 security release batch and published to NVD on August 4, 2026, with a CVSS v3.0 base score of 5.3 (Medium) (Node.js Advisory, GitHub Advisory).

The root cause is classified as CWE-367 (Time-of-check Time-of-use / TOCTOU Race Condition): the SQLTagStore component checks and resets a cached prepared statement's state using sqlite3_reset() directly, but an existing StatementSyncIterator retains a reference to the old statement object and can continue executing it after the reset and rebind with new parameters. This bypasses the iterator invalidation mechanism that was introduced specifically for StatementSync in recent Node.js releases to prevent stale iterator execution. The attack vector is network-based with high attack complexity and requires user interaction, meaning exploitation typically involves a web application that accepts user-controlled input and passes it through DatabaseSync#createTagStore(). No public proof-of-concept code has been identified (Node.js Advisory, GitHub Advisory).

Successful exploitation allows an attacker to manipulate database query results by causing cached SQL prepared statements to execute with stale or incorrect parameters, leading to unintended data modifications or incorrect query outcomes. The integrity impact is rated High, while confidentiality and availability are unaffected, meaning the primary risk is unauthorized data tampering rather than data disclosure or service disruption. The vulnerability is scoped to applications using the node:sqlite module's DatabaseSync#createTagStore() API with user-controlled input, limiting its blast radius to those specific code paths (Node.js Advisory, GitHub Advisory).

There is no evidence of active in-the-wild exploitation, no public proof-of-concept, and no threat actor attribution at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.29–0.32%, indicating a low near-term probability of exploitation. NVD's SSVC assessment confirms exploitation is currently "none" and the attack is not automatable, as it requires user interaction and high attack complexity (GitHub Advisory, Node.js Advisory).

Update Node.js to the patched versions released on July 29, 2026: v22.23.2, v24.18.1, or v26.5.1. As a defense-in-depth measure, review all application code that uses DatabaseSync#createTagStore() with user-controlled input and implement strict input validation and parameterized query patterns. No configuration-based workaround has been published; upgrading to a patched release is the recommended and primary remediation (Node.js Advisory).

The vulnerability was reported to the Node.js project by cantina-security and fixed by Node.js core maintainer mcollina, as acknowledged in the official security advisory. Coverage appeared across security news outlets including CyberSecurityNews and CyberPress, which reported on the broader July 2026 Node.js security release addressing 11 CVEs. Distribution vendors including SUSE and openSUSE issued their own security advisories, and Amazon Linux 2023 published an update advisory. No significant controversy or notable researcher commentary beyond standard patch reporting has been observed (Node.js Advisory, GitHub Advisory).