🎯 New Report #3795900: node:sqlite SQLTagStore Iterator Replay Lets Attacker Re-Execute Victim-Bound Writes Indefinitely
🔺Severity: Medium
👽 Reporter: cantina-security
⭐️ Reputation: 2422
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-06-11
⏰ Disclosed: 2026-08-28 14:15:57
📝 Summary: A flaw was discovered in the node:sqlite package for Node.js that allowed a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it had been reset and rebound with new parameters. The vulnerability was caused by the SQLTagStore feature resetting cached statements using sqlite3 reset() directly, bypassing the iterator invalidation mechanism introduced in recent releases. This issue affected Node.js versions 22.x, 24.x, and 26.x.
📂 Report JSON File: 3795900
@hackeronereports