{
  "cve": [
    "CVE-2026-58045"
  ],
  "vulnerable": "22.x || 24.x || 26.x",
  "patched": "^22.23.2 || ^24.18.1 || ^26.5.1",
  "ref": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
  "description": "Reachable assertion in node:zlib sync API crashes the entire process via spoofed TypedArray byteLength (all 11 *Sync functions affected)",
  "overview": "A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected.\n\nRepeated exploitation of this condition can result in a denial of service.\n\nThis vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.",
  "affectedEnvironments": [
    "all"
  ],
  "severity": "medium"
}