CVE-2026-58045
A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing the entire process to crash. All 11 synchronous zlib function
nodejs nodeRuntimes & languagesCVSS
6.2MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Timeline
- 4 Aug 2026, 00:49 UTCPublishedCVE List
- 23 Oct 2026, 23:45 UTCExploit code publicGitHub proof-of-concept repositories
Reports 2
1 outlet mention it. Reports are not confirmation; each links to its source.
- CompleteTech-LLC/node-cve-2026-58045-check: Standalone defensive checker project for CVE-2026-58045: Node.js: zlib synchronous API spoofed TypedArray crash. One exploit per repository; implementation pending.GitHub proof-of-concept repositories, 23 Oct 2026Exploit code
- CompleTetech-Security/node-cve-2026-58045-check: Standalone defensive checker project for CVE-2026-58045: Node.js: zlib synchronous API spoofed TypedArray crash. One exploit per repository; implementation pending.GitHub proof-of-concept repositories, 23 Oct 2026Exploit code
Description
A flaw in Node.js allows a spoofed TypedArray byteLength to trigger a reachable assertion in the synchronous node:zlib APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected.
Repeated exploitation of this condition can result in a denial of service.
This vulnerability affects Node.js 22.x, 24.x, and 26.x.
Text from CVE List
Affected versions 3
- nodeaffected: 26.5.0 through 26.5.0CVE List
- nodeaffected: 24.18.0 through 24.18.0CVE List
- nodeaffected: 22.23.1 through 22.23.1CVE List