---
title: "CVE-2026-58041: nodejs node vulnerability"
url: https://erroneo.us/security/cve/CVE-2026-58041/
description: "CVE-2026-58041 (nodejs node): A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-08-04
date_modified: 2026-08-04
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-58041"
kev: false
cvss: 5.3
epss: 0.00287
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-58041: nodejs node vulnerability

**Signal:** Normal patch cycle. No exploitation signal; fix it in your next routine update if you are affected. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 0.3% , percentile 20: FIRST’s model estimates a 0.3% chance of exploitation activity in the next 30 days, higher than 20% of all scored CVEs (low). EPSS is a probability, not a verdict.
- Needs a user to click or open something. Phishing makes that realistic, but it is not wormable.
- Editorial verdict: Patch this week. Node.js July 2026 Security Releases: HTTP/2 and 11 CVEs — Routine but real: upgrade every supported Node.js line this week, sooner if you terminate HTTP/2 in Node or rely on the Permission Model as a sandbox.

## What it is

A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3reset() directly, bypassing the iterator invalidation mechanism introduced for StatementSync in recent releases This vulnerability affects Node.js 22.x, 24.x, and 26.x.

## Affected products (CVE record)

- nodejs node: 22.23.1 <= 22.23.1, 24.18.0 <= 24.18.0, 26.5.0 <= 26.5.0

## Severity

- hackerone CVSS 3.0: 5.3 `CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable no , technical impact partial .
- FIRST EPSS (model of 2026-10-21): 0.29% probability of exploitation activity in the next 30 days; percentile 20.

## Sources

- [CVE.org record CVE-2026-58041](https://www.cve.org/CVERecord?id=CVE-2026-58041)
- [NVD entry CVE-2026-58041](https://nvd.nist.gov/vuln/detail/CVE-2026-58041)
- [nodejs.org](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases)

---
Source page: https://erroneo.us/security/cve/CVE-2026-58041/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt