CVE-2026-58041

A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSynccreateTagStore to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3reset directly, bypassing the...

CVE-2026-58041

CVE-2026-58041 affects Node.js with the node:sqlite integration. The issue: a stale StatementSyncIterator created via DatabaseSync#createTagStore() can continue executing a cached prepared statement after it has been reset and rebound with new parameters. The underlying cause is that SQLTagStore ...

PT-2026-67574

Name of the Vulnerable Software and Affected Versions Node.js versions 22.x Node.js versions 24.x Node.js versions 26.x Description A flaw in the node:sqlite module allows a stale StatementSyncIterator created via the DatabaseSynccreateTagStore function to continue executing a cached prepared...