Nodejs: A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached… (CVE-2026-58041)

The vulnerability in Node.js node:sqlite involves the improper handling of cached prepared statements within the StatementSyncIterator created through DatabaseSync#createTagStore(). Specifically, after a cached statement is reset and rebound with new parameters, the stale StatementSyncIterator can continue executing it because SQLTagStore uses sqlite3_reset() directly, which bypasses the iterator invalidation mechanism introduced for StatementSync in recent Node.js releases. This flaw affects Node.js versions 22.x, 24.x, and 26.x and may lead to unintended execution of SQL statements with potentially altered parameters.

The vulnerability allows a stale StatementSyncIterator to execute cached prepared statements after they have been reset and rebound, which could lead to unintended or incorrect SQL statement execution. According to the CVSS vector, the impact is limited to integrity (I:H) with no confidentiality or availability impact. The attack complexity is high, no privileges are required, and user interaction is required, indicating a medium severity level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor official Node.js security advisories for updates and apply patches once available. Until then, cautious use of the affected API and avoiding scenarios that could trigger this flaw may reduce risk.