CVE-2026-58041 Race condition in node
A race condition in Node.js SQLite allows stale iterators to execute cached statements with new parameters, potentially leading to unauthorized data access or modification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-58041?
CVE-2026-58041 is a medium-severity vulnerability in nodejs node, published on 4 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3_reset() directly, bypassing the iterator invalidation mechanism introduced for StatementSync in recent releases This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.
Weakness: CWE-367
Which versions are affected by CVE-2026-58041?
2 open source packages ship an affected version, including node and node-min.
| Package | Affected | Fixed in |
|---|---|---|
node Bitnami | All versions | 22.23.2, 24.18.1, 26.5.1 |
node-min Bitnami | All versions | 22.23.2, 24.18.1, 26.5.1 |
How do I fix CVE-2026-58041?
Upgrade node to a fixed version for your release line: 22.23.2, 24.18.1 or 26.5.1.
Is CVE-2026-58041 being exploited?
There is no known exploitation of CVE-2026-58041 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as ALPINE-CVE-2026-58041, BELL-CVE-2026-58041, BIT-node-2026-58041, BIT-node-min-2026-58041, CLEANSTART-2026-HA97682, DEBIAN-CVE-2026-58041 and 11 more.