{
  "cve": [
    "CVE-2026-58041"
  ],
  "vulnerable": "24.x || 26.x",
  "patched": "^24.18.1 || ^26.5.1",
  "ref": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
  "description": "node:sqlite SQLTagStore Iterator Replay Lets Attacker Re-Execute Victim-Bound Writes Indefinitely",
  "overview": "A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3_reset() directly, bypassing the iterator invalidation mechanism introduced for StatementSync in recent releases\n\nThis vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.",
  "affectedEnvironments": [
    "all"
  ],
  "severity": "medium"
}