CVE-2026-58041

A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3_reset() directly, bypassing the iterator invalidation mechanism introduced for StatementSync in recent releases This vulnerability affects Node.js 22.x, 24.x, and 26.x.

A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3_reset() directly, bypassing the iterator invalidation mechanism introduced for StatementSync in recent releases This vulnerability affects Node.js 22.x, 24.x, and 26.x.

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

• nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043)
• nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)
• nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)

Bug Fix(es) and Enhancement(s):

• nodejs24: Rebase to the latest Node.js 24 release [almalinux-10.2.z] (JIRA:AlmaLinux-220543)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043)
• nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)
• nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043)
• nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)
• nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3_reset() directly, bypassing the iterator invalidation mechanism introduced for StatementSync in recent releases

This vulnerability affects Node.js 22.x, 24.x, and 26.x.

A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3_reset() directly, bypassing the iterator invalidation mechanism introduced for StatementSync in recent releases

This vulnerability affects Node.js 22.x, 24.x, and 26.x.

These are all security issues fixed in the corepack24-24.18.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the nodejs26-26.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for nodejs24 fixes the following issues:

Update to 24.18.1.

• CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
• CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
• CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).
• CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
• CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
• CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).
• CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
• CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
• CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
• CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
• CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).

This update for nodejs24 fixes the following issues:

Update to 24.18.1.

• CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
• CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
• CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).
• CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
• CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
• CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).
• CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
• CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
• CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
• CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
• CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).

This update for nodejs24 fixes the following issues:

Update to 24.18.1.

• CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
• CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
• CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).
• CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
• CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
• CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).
• CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
• CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
• CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
• CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
• CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).

This update for nodejs24 fixes the following issues:

Update to 24.18.1.

• CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
• CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
• CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).
• CVE-2026-56848: HTTP/2 re-entrant send can cause heap use-after-free (bsc#1272942).
• CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
• CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).
• CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
• CVE-2026-58041: node:sqlite SQLTagStore iterator replay can re-execute writes (bsc#1272946).
• CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
• CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
• CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
• CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).

Other updates and bugfixes:

• Version 24.18.0:
  • fix: severe regression in security update 24.17 of nodejs24 (bsc#1269825)
  • doc: update blockList stability status to release candidate
  • fs: support caller-supplied readFile() buffers
  • http: close pre-request sockets in closeIdleConnections
  • loader: implement package maps
  • net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive
  • tls: add certificateCompression option
  • vfs: dispatch node:fs/promises to mounted VFS instances
  • vfs: add minimal node:vfs subsystem