A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3_reset() directly, bypassing the iterator invalidation mechanism introduced for StatementSync in recent releases
This vulnerability affects Node.js 22.x, 24.x, and 26.x.
Weakness
The product checks the state of a resource before using that resource, but the resource’s state can change between the check and the use in a way that invalidates the results of the check.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Red Hat Enterprise Linux 10 | RedHat | nodejs24-1:24.19.0-1.el10_2 | * |
| Red Hat Enterprise Linux 8 | RedHat | nodejs:24-8100020260819113942.6d880403 | * |
| Red Hat Enterprise Linux 9 | RedHat | nodejs:24-9080020260819113946.rhel9 | * |
| Red Hat Hardened Images | RedHat | nodejs22-main-10.9.8-1.22.23.2.2.3.hum1 | * |
| Red Hat Hardened Images | RedHat | nodejs22-main-22.23.2-2.3.hum1 | * |
| Red Hat Hardened Images | RedHat | nodejs24-main-11.16.0-1.24.18.1.0.1.hum1 | * |
| Red Hat Hardened Images | RedHat | nodejs24-main-24.18.1-0.1.hum1 | * |
| Red Hat Hardened Images | RedHat | nodejs26-main-11.19.0-1.26.7.0.1.5.1.hum1 | * |
| Red Hat Hardened Images | RedHat | nodejs26-main-26.7.0-1.5.1.hum1 | * |