CVE-2026-58045: 
npm vulnerability analysis and mitigation

CVE-2026-58045 is a denial-of-service vulnerability in Node.js's synchronous node:zlib APIs, where a spoofed TypedArray byteLength value can trigger a reachable assertion, causing the entire Node.js process to crash. All 11 synchronous zlib functions are affected. The vulnerability was reported by researcher "byvini" and fixed by RafaelGSS, with the advisory published on August 4, 2026 as part of Node.js's July 2026 security release batch. It affects Node.js 22.x (≤22.23.1), 24.x (≤24.18.0), and 26.x (≤26.5.0). It carries a CVSS v3.0 base score of 6.2 (Medium) (Node.js Advisory, GitHub Advisory).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption). An attacker can craft a TypedArray object with a spoofed byteLength property and pass it to any of the 11 synchronous zlib API functions (e.g., zlib.deflateSync(), zlib.inflateSync()). The spoofed length causes an internal assertion check within the node:zlib module to fail, which terminates the entire Node.js process rather than throwing a catchable error. The attack vector is local (AV:L), requires no privileges, and no user interaction, making it straightforward to trigger for any code path that processes attacker-controlled input through synchronous zlib functions (Node.js Advisory, GitHub Advisory).

Successful exploitation results in an immediate crash of the Node.js process, causing a complete loss of availability for any application relying on it. There is no confidentiality or integrity impact — the vulnerability is purely a denial-of-service condition. Repeated triggering of the crash can sustain a persistent denial-of-service state against Node.js-based services that use synchronous zlib compression or decompression in their processing pipeline (Node.js Advisory, GitHub Advisory).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at this time. The NVD SSVC assessment classifies exploitation as "none" and the attack as not automatable. The EPSS score is approximately 0.19%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Node.js Advisory).

1. Identify target: Locate a Node.js application (version 22.x ≤22.23.1, 24.x ≤24.18.0, or 26.x ≤26.5.0) that accepts attacker-controlled input and passes it through any synchronous node:zlib API function.
2. Craft malicious TypedArray: Create a TypedArray (e.g., Uint8Array) with a spoofed byteLength property — for example, by manipulating the underlying ArrayBuffer or using a Proxy to override the byteLength getter to return a value inconsistent with the actual buffer size.
3. Invoke synchronous zlib function: Pass the crafted TypedArray as input to one of the 11 affected synchronous functions, such as zlib.deflateSync(maliciousTypedArray) or zlib.inflateSync(maliciousTypedArray).
4. Trigger assertion failure: The inconsistent byteLength causes an internal C++ assertion within the zlib binding to fail, immediately terminating the Node.js process with an unhandled abort signal.
5. Repeat for sustained DoS: Repeatedly send crafted inputs to keep the service unavailable, as each crash terminates the process (Node.js Advisory, GitHub Advisory).

• Logs: Sudden, unexplained Node.js process terminations logged by the OS or process manager (e.g., systemd, PM2) with abort/signal 6 (SIGABRT) exit codes; application logs showing abrupt cutoff without graceful shutdown messages.
• Process: Node.js process repeatedly restarting in a short time window; core dump files generated in the working directory of the Node.js application following assertion failures.
• Network: Unusual or malformed input payloads delivered to application endpoints that invoke synchronous zlib operations, particularly inputs with inconsistent size metadata.

Upgrade Node.js to the patched versions released on July 29, 2026: v22.23.2, v24.18.1, or v26.5.1. If immediate patching is not possible, restrict local access to systems running vulnerable Node.js versions and avoid exposing synchronous zlib API call paths to untrusted input. Monitoring for unexpected process terminations can help detect exploitation attempts in the interim (Node.js Advisory).

The vulnerability was part of a broader July 2026 Node.js security release addressing 11 CVEs, which received coverage from security news outlets including CyberSecurityNews and CyberPress. SUSE and openSUSE issued their own security advisories and package updates for affected Node.js versions. Amazon Linux 2023 also issued an advisory (ALAS2023-2026-2060). The broader release was noted for addressing multiple high-severity issues alongside this medium-severity DoS flaw (Node.js Advisory).