CVE-2026-58041
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-58041
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3_reset() directly, bypassing the iterator invalidation mechanism introduced for StatementSync in recent releases This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
检查时间与使用时间(TOCTOU)的竞争条件
Source: CVE Program / CVE List V5
Vulnerability Title
Node.js 竞争条件问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Node.js是Node.js基金会开源的一个跨平台的 JavaScript 运行时环境。 Node.js存在竞争条件问题漏洞，可能导致攻击者利用漏洞破坏系统的机密性、完整性或可用性。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-58041
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-58041
请登录查看更多情报信息。
Security Blog Posts for CVE-2026-58041 (1)
Same Patch Batch · nodejs · 2026-08-04 · 6 CVEs total
| CVE-2026-58045 | nodejs node 资源管理错误漏洞 | |
| CVE-2026-58042 | nodejs node 资源管理错误漏洞 | |
| CVE-2026-58044 | nodejs node 输入验证错误漏洞 | |
| CVE-2026-56846 | Node.js 资源管理错误漏洞 | |
| CVE-2026-56848 | Node.js 资源管理错误漏洞 |
IV. Related Vulnerabilities
Same weakness: CWE-367
- CVE-2026-57818
Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in J - CVE-2026-55524
PraisonAI: SSRF in web_crawl tool via redirect-following and - CVE-2026-70597
Electron: Parent process code-sign check is spoofable - CVE-2026-71272
Memos Webhook DNS Rebinding TOCTOU SSRF in safeDialContext() - CVE-2026-71210
mealie: DNS-Rebinding TOCTOU in SSRF Guard Allows Internal N
V. Comments for CVE-2026-58041
No comments yet