AIKIDO-2026-35472
node is vulnerable to Operation on a Resource after Expiration or Release
49
Medium Risk
This Affects:
nodeTL;DR
In Node.js, node:sqlite SQLTagStore can replay a stale StatementSyncIterator after the underlying prepared statement has been reset and rebound with new parameters. Because the cached prepared statement continues executing, this can cause unintended re-execution of cached writes.
Who does this affect?
You are affected if you use node:sqlite DatabaseSync#createTagStore()/SQLTagStore statement caching and continue to use a StatementSyncIterator after its underlying statement has been reset and rebound with new parameters.
Background info
node is vulnerable to Operation on a Resource after Expiration or Release in versions 25.0.0 - 26.5.0 and 24.0.0 - 24.18.0.
How to fix this
Upgrade the node library to a patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant