CVE-2026-58045

A flaw was found in Node.js. A malicious actor could exploit this vulnerability by providing a specially crafted input to the synchronous node:zlib APIs. This could cause the Node.js process to crash, leading to a denial of service and making the application unavailable to users.

This flaw strictly impacts Availability with zero effect on Confidentiality or Integrity (C:N, I:N, A:H). Practical exploitation occurs when an application passes attacker-controlled typed array objects into synchronous node:zlib functions, triggering an internal assertion and crashing the Node.js process. Applications using asynchronous node:zlib routines or processing standard binary buffers are unaffected. Both Red Hat and CVEOrg scores align at 6.2 (Moderate) with a Local attack vector (AV:L), reflecting that an attacker must be able to inject malformed array structures directly into the application's synchronous data stream.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.