CVE-2026-58045

Awaiting Analysis Awaiting Analysis - Queue

Denial of Service in Node.js zlib Synchronous APIs

Publication date: 2026-08-04

Last updated on: 2026-10-23

Assigner: HackerOne

Description

A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected. Repeated exploitation of this condition can result in a denial of service. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-04

Last Modified

2026-10-23

Generated

2026-11-08

AI Q&A

2026-08-04

EPSS Evaluated

2026-11-07

NVD

CVE-2026-58045

EUVD

EUVD-2026-52562

Affected Vendors & Products

Vendor	Product	Version / Range
nodejs	node.js	22.x
nodejs	node.js	24.x
nodejs	node.js	26.x

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability is a flaw in Node.js where a spoofed TypedArray byteLength can trigger an assertion error in synchronous node:zlib APIs. This causes the entire Node.js process to crash. All 11 synchronous zlib functions are affected by this issue.

Detection Guidance

This vulnerability cannot be directly detected through standard commands as it involves a flaw in Node.js's synchronous zlib APIs. Monitoring for unexpected Node.js process crashes or denial of service events may indicate exploitation. Ensure Node.js is updated to patched versions.

Impact Analysis

Repeated exploitation of this vulnerability can lead to a denial of service, crashing applications that rely on Node.js and the affected zlib functions. This disrupts service availability for users and systems dependent on these functions.

Compliance Impact

This vulnerability causes a denial of service by crashing Node.js processes through spoofed TypedArray byteLength in synchronous zlib APIs. While not directly violating GDPR or HIPAA, such crashes could disrupt data processing or availability, potentially impacting compliance with availability requirements in these regulations.

Mitigation Strategies

Update Node.js to the latest patched version to address the flaw in synchronous zlib APIs. Avoid using synchronous zlib functions if possible. Monitor for crashes in Node.js processes as a potential indicator of exploitation.

Hi! I’m here to help you understand CVE-2026-58045. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...