Log in Start free

Vulnerability · Published Aug 4, 2026 · Assigned by hackerone

CVE-2026-58045

Medium 6.2

In plain English

A medium-severity uncontrolled resource consumption in node from nodejs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.0)6.2Medium
Exploit odds (30 days)0.2%top 94.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected. Repeated exploitation of this condition can result in a denial of service. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10nodejs1:22.23.2-1.el10_2ALSA-2026:61376
AlmaLinux:8nodejs1:24.19.0-1.module_el8.10.0+4268+8e07aa5aALSA-2026:62583
AlmaLinux:8nodejs1:22.23.2-1.module_el8.10.0+4265+75d28086ALSA-2026:62219
AlmaLinux:9nodejs1:24.19.0-1.module_el9.8.0+301+084fac05ALSA-2026:61386
AlmaLinux:9nodejs1:22.23.2-1.module_el9.8.0+302+959ebcd4ALSA-2026:61383
AlmaLinux:10nodejs-devel1:22.23.2-1.el10_2ALSA-2026:61376
AlmaLinux:8nodejs-devel1:22.23.2-1.module_el8.10.0+4265+75d28086ALSA-2026:62219
AlmaLinux:8nodejs-devel1:24.19.0-1.module_el8.10.0+4268+8e07aa5aALSA-2026:62583
AlmaLinux:9nodejs-devel1:22.23.2-1.module_el9.8.0+302+959ebcd4ALSA-2026:61383
AlmaLinux:9nodejs-devel1:24.19.0-1.module_el9.8.0+301+084fac05ALSA-2026:61386
AlmaLinux:10nodejs-docs1:22.23.2-1.el10_2ALSA-2026:61376
AlmaLinux:8nodejs-docs1:24.19.0-1.module_el8.10.0+4268+8e07aa5aALSA-2026:62583
AlmaLinux:8nodejs-docs1:22.23.2-1.module_el8.10.0+4265+75d28086ALSA-2026:62219
AlmaLinux:9nodejs-docs1:22.23.2-1.module_el9.8.0+302+959ebcd4ALSA-2026:61383
AlmaLinux:9nodejs-docs1:24.19.0-1.module_el9.8.0+301+084fac05ALSA-2026:61386
AlmaLinux:10nodejs-full-i18n1:22.23.2-1.el10_2ALSA-2026:61376
AlmaLinux:8nodejs-full-i18n1:24.19.0-1.module_el8.10.0+4268+8e07aa5aALSA-2026:62583
AlmaLinux:8nodejs-full-i18n1:22.23.2-1.module_el8.10.0+4265+75d28086ALSA-2026:62219
AlmaLinux:9nodejs-full-i18n1:22.23.2-1.module_el9.8.0+302+959ebcd4ALSA-2026:61383
AlmaLinux:9nodejs-full-i18n1:24.19.0-1.module_el9.8.0+301+084fac05ALSA-2026:61386
AlmaLinux:10nodejs-libs1:22.23.2-1.el10_2ALSA-2026:61376
AlmaLinux:8nodejs-libs1:24.19.0-1.module_el8.10.0+4268+8e07aa5aALSA-2026:62583
AlmaLinux:8nodejs-libs1:22.23.2-1.module_el8.10.0+4265+75d28086ALSA-2026:62219
AlmaLinux:9nodejs-libs1:24.19.0-1.module_el9.8.0+301+084fac05ALSA-2026:61386
AlmaLinux:9nodejs-libs1:22.23.2-1.module_el9.8.0+302+959ebcd4ALSA-2026:61383
AlmaLinux:8nodejs-nodemon3.1.14-2.module_el8.10.0+4250+09238ed4ALSA-2026:62583
AlmaLinux:8nodejs-nodemon3.1.14-2.module_el8.10.0+4252+aedd4c30ALSA-2026:62219
AlmaLinux:9nodejs-nodemon3.1.14-3.module_el9.8.0+292+f4eaf8b2ALSA-2026:61386
AlmaLinux:9nodejs-nodemon3.1.14-2.module_el9.8.0+291+0bb98cceALSA-2026:61383
AlmaLinux:10nodejs-npm1:10.9.8-1.22.23.2.1.el10_2ALSA-2026:61376
AlmaLinux:8nodejs-packaging2021.06-6.module_el8.10.0+4158+e796f37fALSA-2026:62219
AlmaLinux:8nodejs-packaging2021.06-6.module_el8.10.0+4086+70facd4aALSA-2026:62583
AlmaLinux:9nodejs-packaging2021.06-6.module_el9.7.0+209+ecf6523eALSA-2026:61386
AlmaLinux:9nodejs-packaging2021.06-6.module_el9.7.0+227+12323393ALSA-2026:61383
AlmaLinux:8nodejs-packaging-bundler2021.06-6.module_el8.10.0+4086+70facd4aALSA-2026:62583
AlmaLinux:8nodejs-packaging-bundler2021.06-6.module_el8.10.0+4158+e796f37fALSA-2026:62219
AlmaLinux:9nodejs-packaging-bundler2021.06-6.module_el9.7.0+209+ecf6523eALSA-2026:61386
AlmaLinux:9nodejs-packaging-bundler2021.06-6.module_el9.7.0+227+12323393ALSA-2026:61383
AlmaLinux:10nodejs241:24.19.0-1.el10_2ALSA-2026:61377
AlmaLinux:10nodejs24-devel1:24.19.0-1.el10_2ALSA-2026:61377
AlmaLinux:10nodejs24-docs1:24.19.0-1.el10_2ALSA-2026:61377
AlmaLinux:10nodejs24-full-i18n1:24.19.0-1.el10_2ALSA-2026:61377
AlmaLinux:10nodejs24-libs1:24.19.0-1.el10_2ALSA-2026:61377
AlmaLinux:10nodejs24-npm1:11.17.0-1.24.19.0.1.el10_2ALSA-2026:61377
AlmaLinux:8npm1:10.9.8-1.22.23.2.1.module_el8.10.0+4265+75d28086ALSA-2026:62219
AlmaLinux:8npm1:11.17.0-1.24.19.0.1.module_el8.10.0+4268+8e07aa5aALSA-2026:62583
AlmaLinux:9npm1:11.17.0-1.24.19.0.1.module_el9.8.0+301+084fac05ALSA-2026:61386
AlmaLinux:9npm1:10.9.8-1.22.23.2.1.module_el9.8.0+302+959ebcd4ALSA-2026:61383
AlmaLinux:8v8-12.4-devel3:12.4.254.21-1.22.23.2.1.module_el8.10.0+4265+75d28086ALSA-2026:62219
AlmaLinux:9v8-12.4-devel3:12.4.254.21-1.22.23.2.1.module_el9.8.0+302+959ebcd4ALSA-2026:61383
AlmaLinux:8v8-13.6-devel3:13.6.233.17-1.24.19.0.1.module_el8.10.0+4268+8e07aa5aALSA-2026:62583
AlmaLinux:9v8-13.6-devel3:13.6.233.17-1.24.19.0.1.module_el9.8.0+301+084fac05ALSA-2026:61386
Alpine:v3.21nodejs22.23.2-r0ALPINE-CVE-2026-58045
Alpine:v3.22nodejs22.23.2-r0ALPINE-CVE-2026-58045
Alpine:v3.23nodejs24.18.1-r0ALPINE-CVE-2026-58045
Alpine:v3.24nodejs24.18.1-r0ALPINE-CVE-2026-58045
Alpine:v3.24nodejs-current26.5.1-r0ALPINE-CVE-2026-58045
Debian:12nodejsno fix listedDEBIAN-CVE-2026-58045
Debian:13nodejsno fix listedDEBIAN-CVE-2026-58045
Debian:14nodejs24.19.0+dfsg+~cs24.13.3-1DEBIAN-CVE-2026-58045
Ubuntu:24.04:LTSnodejsno fix listedUBUNTU-CVE-2026-58045
Ubuntu:26.04:LTSnodejsno fix listedUBUNTU-CVE-2026-58045
Ubuntu:26.10nodejsno fix listedUBUNTU-CVE-2026-58045

Affected products (as reported)

VendorProductVersions
nodejs node 26.5.0 – through 26.5.024.18.0 – through 24.18.022.23.1 – through 22.23.1

Weakness: CWE-400 · Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References