Medium severity6.2NVD Advisory· Published Aug 4, 2026· Updated Sep 3, 2026
CVE-2026-58045
CVE-2026-58045
Description
A flaw in Node.js allows a spoofed TypedArray byteLength to trigger a reachable assertion in the synchronous node:zlib APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected.
Repeated exploitation of this condition can result in a denial of service.
This vulnerability affects Node.js 22.x, 24.x, and 26.x.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
8- osv-coords6 versionspkg:rpm/opensuse/nodejs22&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/nodejs24&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/nodejs26&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/nodejs24&distro=openSUSE%20Tumbleweedpkg:bitnami/nodepkg:bitnami/node-min
< 22.23.2-160000.1.1+ 5 more
- (no CPE)range: < 22.23.2-160000.1.1
- (no CPE)range: < 24.18.1-160000.1.1
- (no CPE)range: < 26.5.1-1.1
- (no CPE)range: < 24.18.1-1.1
- (no CPE)range: < 22.23.2
- (no CPE)range: < 22.23.2
Patches
Vulnerability mechanics
References
1News mentions
1- Node.js Fixes 11 Security Flaws That Can Crash Servers and Break Filesystem RestrictionsCyber Security News · Jul 30, 2026