CVE-2026-58045
Received Received - Intake

Denial of Service in Node.js zlib Synchronous APIs

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: HackerOne

Description
A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected. Repeated exploitation of this condition can result in a denial of service. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-58045
EUVD
EUVD-2026-52562

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
nodejs node.js 22.x
nodejs node.js 24.x
nodejs node.js 26.x

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a flaw in Node.js where a spoofed TypedArray byteLength can trigger an assertion error in synchronous node:zlib APIs. This causes the entire Node.js process to crash. All 11 synchronous zlib functions are affected by this issue.

Detection Guidance

This vulnerability cannot be directly detected through standard commands as it involves a flaw in Node.js's synchronous zlib APIs. Monitoring for unexpected Node.js process crashes or denial of service events may indicate exploitation. Ensure Node.js is updated to patched versions.

Impact Analysis

Repeated exploitation of this vulnerability can lead to a denial of service, crashing applications that rely on Node.js and the affected zlib functions. This disrupts service availability for users and systems dependent on these functions.

Compliance Impact

This vulnerability causes a denial of service by crashing Node.js processes through spoofed TypedArray byteLength in synchronous zlib APIs. While not directly violating GDPR or HIPAA, such crashes could disrupt data processing or availability, potentially impacting compliance with availability requirements in these regulations.

Mitigation Strategies

Update Node.js to the latest patched version to address the flaw in synchronous zlib APIs. Avoid using synchronous zlib functions if possible. Monitor for crashes in Node.js processes as a potential indicator of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58045. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart