CVE-2026-58041

A flaw was found in Node.js's node:sqlite module. This vulnerability allows a previously used database statement, which should have been reset, to be re-executed with new parameters. This could lead to unintended data modifications or integrity issues within the application.

This flaw strictly impacts data Integrity with zero effect on Confidentiality or Availability (C:N, I:H, A:N). Practical exploitation occurs when an application utilizes the experimental node:sqlite SQL tag store feature while managing statement iterators. Under these high-complexity conditions (AC:H) requiring specific user-driven interaction sequences (UI:R), a stale iterator can execute a reset statement with new parameters, leading to unintended database writes. Applications that do not use node:sqlite tag stores or statement iterators are completely unaffected. Red Hat and upstream CVSS scores align at 5.3 (Moderate) due to these strict operational constraints.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Applications using Node.js that leverage the experimental node:sqlite SQL tag store feature should avoid using DatabaseSync#createTagStore() and StatementSyncIterator to prevent unintended data modification. If this feature is not essential, refactoring the application to remove its usage will mitigate the vulnerability.