Repeated exploitation of this condition can result in a denial of service.
This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| nodejs | node | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Tue, 04 Aug 2026 16:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Tue, 04 Aug 2026 01:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected. Repeated exploitation of this condition can result in a denial of service. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**. | |
| Weaknesses | CWE-400 | |
| References |
| |
| Metrics |
cvssV3_0
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: hackerone
Published:
Updated: 2026-08-04T15:03:57.326Z
Reserved: 2026-06-27T15:00:00.780Z
Link: CVE-2026-58045
Vulnrichment
Updated: 2026-08-04T14:19:41.292Z
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.