Executive brief
Node.js includes a built-in SQLite database module used by applications to store and query local data. A flaw allows a stale iterator object to continue re-executing cached database write statements even after those statements have been reset and rebound with new parameters. An attacker could replay write operations with unintended data, potentially corrupting application state or manipulating stored data.
Technical details
The vulnerability is an iterator replay flaw in Node.js node:sqlite's SQLTagStore implementation. When DatabaseSync#createTagStore() creates a StatementSyncIterator, the iterator can continue executing a cached prepared statement after that statement has been reset via sqlite3_reset() and rebound with new parameters. The root cause is that SQLTagStore bypasses the iterator invalidation mechanism introduced for StatementSync, meaning stale iterators remain active. The vulnerability requires application code to use the affected createTagStore() API and retain references to iterators across statement resets. An attacker or malicious application logic can exploit this to replay write operations with different parameters, potentially causing data corruption or unintended state changes. Patches are available in Node.js 26.x, 24.x, and 22.x maintenance releases.
Affected products
- Node.js Node.js 22.x, 24.x, 26.x
Timeline
- 2026-07-29: disclosed: Public disclosure via Node.js security advisory
- 2026-07-29: patched: Patches released for 26.x, 24.x, and 22.x release lines