CVE-2026-58045
Published: August 4th, 2026
A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected.
Repeated exploitation of this condition can result in a denial of service.
This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.
MEDIUM
CVSS v3: 6.2
CVSS v3: 6.2
Status
| DocFilters Release | Package | State | Justification | Comment |
|---|---|---|---|---|
| 26.3 | zlib (1.3) | Not Affected | Code Not Present | CVE-2026-58045 is a defect in the Node.js runtime’s own zlib binding layer, not in the zlib library. The upstream fix (nodejs/node commit 0d072480c3dbbad6db8723e39786321646989343) changes only src/node_zlib.cc, replacing two CHECK(Buffer::IsWithinBounds(…)) assertions in CompressionStream::Write with THROW_ERR_OUT_OF_RANGE so a JavaScript object with a spoofed byteLength getter raises a RangeError instead of aborting the process; no zlib source file is touched. That the affected surface includes zlib.brotliCompressSync, zlib.brotliDecompressSync, zlib.zstdCompressSync, and zlib.zstdDecompressSync – codecs zlib does not implement – further confirms the defect lives in Node’s shared binding wrapper rather than in zlib. Document Filters is a C++ SDK with .NET/Python/Java bindings; it embeds no Node.js runtime, no V8, and no N-API/NAN addon, so the vulnerable CompressionStream::Write code and the V8 TypedArray spoofing primitive it depends on are not present in the tree at all (no node_zlib.cc, no Buffer::IsWithinBounds, no THROW_ERR_OUT_OF_RANGE). Document Filters calls zlib’s C API directly from shared/core/source/ISYScompressedstream.cpp and ISYSzipfile.cpp with buffer offsets and lengths it computes itself in native code, where no spoofable byteLength accessor exists. The only package.json in the repository (filters/tools/isys_readergen) is an internal build-time code generator depending solely on @types/node and commander; it is not shipped, does not use node:zlib, and no Node.js runtime is redistributed with the product. |
| 26.2 | zlib (1.3) | Not Affected | Code Not Present | CVE-2026-58045 is a defect in the Node.js runtime’s own zlib binding layer, not in the zlib library. The upstream fix (nodejs/node commit 0d072480c3dbbad6db8723e39786321646989343) changes only src/node_zlib.cc, replacing two CHECK(Buffer::IsWithinBounds(…)) assertions in CompressionStream::Write with THROW_ERR_OUT_OF_RANGE so a JavaScript object with a spoofed byteLength getter raises a RangeError instead of aborting the process; no zlib source file is touched. That the affected surface includes zlib.brotliCompressSync, zlib.brotliDecompressSync, zlib.zstdCompressSync, and zlib.zstdDecompressSync – codecs zlib does not implement – further confirms the defect lives in Node’s shared binding wrapper rather than in zlib. Document Filters is a C++ SDK with .NET/Python/Java bindings; it embeds no Node.js runtime, no V8, and no N-API/NAN addon, so the vulnerable CompressionStream::Write code and the V8 TypedArray spoofing primitive it depends on are not present in the tree at all (no node_zlib.cc, no Buffer::IsWithinBounds, no THROW_ERR_OUT_OF_RANGE). Document Filters calls zlib’s C API directly from shared/core/source/ISYScompressedstream.cpp and ISYSzipfile.cpp with buffer offsets and lengths it computes itself in native code, where no spoofable byteLength accessor exists. The only package.json in the repository (filters/tools/isys_readergen) is an internal build-time code generator depending solely on @types/node and commander; it is not shipped, does not use node:zlib, and no Node.js runtime is redistributed with the product. |
| 26.1 | zlib (1.3) | Not Affected | Code Not Present | CVE-2026-58045 is a defect in the Node.js runtime’s own zlib binding layer, not in the zlib library. The upstream fix (nodejs/node commit 0d072480c3dbbad6db8723e39786321646989343) changes only src/node_zlib.cc, replacing two CHECK(Buffer::IsWithinBounds(…)) assertions in CompressionStream::Write with THROW_ERR_OUT_OF_RANGE so a JavaScript object with a spoofed byteLength getter raises a RangeError instead of aborting the process; no zlib source file is touched. That the affected surface includes zlib.brotliCompressSync, zlib.brotliDecompressSync, zlib.zstdCompressSync, and zlib.zstdDecompressSync – codecs zlib does not implement – further confirms the defect lives in Node’s shared binding wrapper rather than in zlib. Document Filters is a C++ SDK with .NET/Python/Java bindings; it embeds no Node.js runtime, no V8, and no N-API/NAN addon, so the vulnerable CompressionStream::Write code and the V8 TypedArray spoofing primitive it depends on are not present in the tree at all (no node_zlib.cc, no Buffer::IsWithinBounds, no THROW_ERR_OUT_OF_RANGE). Document Filters calls zlib’s C API directly from shared/core/source/ISYScompressedstream.cpp and ISYSzipfile.cpp with buffer offsets and lengths it computes itself in native code, where no spoofable byteLength accessor exists. The only package.json in the repository (filters/tools/isys_readergen) is an internal build-time code generator depending solely on @types/node and commander; it is not shipped, does not use node:zlib, and no Node.js runtime is redistributed with the product. |
| 25.4 | zlib (1.3) | Not Affected | Code Not Present | CVE-2026-58045 is a defect in the Node.js runtime’s own zlib binding layer, not in the zlib library. The upstream fix (nodejs/node commit 0d072480c3dbbad6db8723e39786321646989343) changes only src/node_zlib.cc, replacing two CHECK(Buffer::IsWithinBounds(…)) assertions in CompressionStream::Write with THROW_ERR_OUT_OF_RANGE so a JavaScript object with a spoofed byteLength getter raises a RangeError instead of aborting the process; no zlib source file is touched. That the affected surface includes zlib.brotliCompressSync, zlib.brotliDecompressSync, zlib.zstdCompressSync, and zlib.zstdDecompressSync – codecs zlib does not implement – further confirms the defect lives in Node’s shared binding wrapper rather than in zlib. Document Filters is a C++ SDK with .NET/Python/Java bindings; it embeds no Node.js runtime, no V8, and no N-API/NAN addon, so the vulnerable CompressionStream::Write code and the V8 TypedArray spoofing primitive it depends on are not present in the tree at all (no node_zlib.cc, no Buffer::IsWithinBounds, no THROW_ERR_OUT_OF_RANGE). Document Filters calls zlib’s C API directly from shared/core/source/ISYScompressedstream.cpp and ISYSzipfile.cpp with buffer offsets and lengths it computes itself in native code, where no spoofable byteLength accessor exists. The only package.json in the repository (filters/tools/isys_readergen) is an internal build-time code generator depending solely on @types/node and commander; it is not shipped, does not use node:zlib, and no Node.js runtime is redistributed with the product. |
| 25.3 | zlib (1.3) | Not Affected | Code Not Present | CVE-2026-58045 is a defect in the Node.js runtime’s own zlib binding layer, not in the zlib library. The upstream fix (nodejs/node commit 0d072480c3dbbad6db8723e39786321646989343) changes only src/node_zlib.cc, replacing two CHECK(Buffer::IsWithinBounds(…)) assertions in CompressionStream::Write with THROW_ERR_OUT_OF_RANGE so a JavaScript object with a spoofed byteLength getter raises a RangeError instead of aborting the process; no zlib source file is touched. That the affected surface includes zlib.brotliCompressSync, zlib.brotliDecompressSync, zlib.zstdCompressSync, and zlib.zstdDecompressSync – codecs zlib does not implement – further confirms the defect lives in Node’s shared binding wrapper rather than in zlib. Document Filters is a C++ SDK with .NET/Python/Java bindings; it embeds no Node.js runtime, no V8, and no N-API/NAN addon, so the vulnerable CompressionStream::Write code and the V8 TypedArray spoofing primitive it depends on are not present in the tree at all (no node_zlib.cc, no Buffer::IsWithinBounds, no THROW_ERR_OUT_OF_RANGE). Document Filters calls zlib’s C API directly from shared/core/source/ISYScompressedstream.cpp and ISYSzipfile.cpp with buffer offsets and lengths it computes itself in native code, where no spoofable byteLength accessor exists. The only package.json in the repository (filters/tools/isys_readergen) is an internal build-time code generator depending solely on @types/node and commander; it is not shipped, does not use node:zlib, and no Node.js runtime is redistributed with the product. |
| 25.2 | zlib (1.3) | Not Affected | Code Not Present | CVE-2026-58045 is a defect in the Node.js runtime’s own zlib binding layer, not in the zlib library. The upstream fix (nodejs/node commit 0d072480c3dbbad6db8723e39786321646989343) changes only src/node_zlib.cc, replacing two CHECK(Buffer::IsWithinBounds(…)) assertions in CompressionStream::Write with THROW_ERR_OUT_OF_RANGE so a JavaScript object with a spoofed byteLength getter raises a RangeError instead of aborting the process; no zlib source file is touched. That the affected surface includes zlib.brotliCompressSync, zlib.brotliDecompressSync, zlib.zstdCompressSync, and zlib.zstdDecompressSync – codecs zlib does not implement – further confirms the defect lives in Node’s shared binding wrapper rather than in zlib. Document Filters is a C++ SDK with .NET/Python/Java bindings; it embeds no Node.js runtime, no V8, and no N-API/NAN addon, so the vulnerable CompressionStream::Write code and the V8 TypedArray spoofing primitive it depends on are not present in the tree at all (no node_zlib.cc, no Buffer::IsWithinBounds, no THROW_ERR_OUT_OF_RANGE). Document Filters calls zlib’s C API directly from shared/core/source/ISYScompressedstream.cpp and ISYSzipfile.cpp with buffer offsets and lengths it computes itself in native code, where no spoofable byteLength accessor exists. The only package.json in the repository (filters/tools/isys_readergen) is an internal build-time code generator depending solely on @types/node and commander; it is not shipped, does not use node:zlib, and no Node.js runtime is redistributed with the product. |
| 25.1 | zlib (1.3) | Not Affected | Code Not Present | CVE-2026-58045 is a defect in the Node.js runtime’s own zlib binding layer, not in the zlib library. The upstream fix (nodejs/node commit 0d072480c3dbbad6db8723e39786321646989343) changes only src/node_zlib.cc, replacing two CHECK(Buffer::IsWithinBounds(…)) assertions in CompressionStream::Write with THROW_ERR_OUT_OF_RANGE so a JavaScript object with a spoofed byteLength getter raises a RangeError instead of aborting the process; no zlib source file is touched. That the affected surface includes zlib.brotliCompressSync, zlib.brotliDecompressSync, zlib.zstdCompressSync, and zlib.zstdDecompressSync – codecs zlib does not implement – further confirms the defect lives in Node’s shared binding wrapper rather than in zlib. Document Filters is a C++ SDK with .NET/Python/Java bindings; it embeds no Node.js runtime, no V8, and no N-API/NAN addon, so the vulnerable CompressionStream::Write code and the V8 TypedArray spoofing primitive it depends on are not present in the tree at all (no node_zlib.cc, no Buffer::IsWithinBounds, no THROW_ERR_OUT_OF_RANGE). Document Filters calls zlib’s C API directly from shared/core/source/ISYScompressedstream.cpp and ISYSzipfile.cpp with buffer offsets and lengths it computes itself in native code, where no spoofable byteLength accessor exists. The only package.json in the repository (filters/tools/isys_readergen) is an internal build-time code generator depending solely on @types/node and commander; it is not shipped, does not use node:zlib, and no Node.js runtime is redistributed with the product. |
| 24.4 | zlib (1.3) | Not Affected | Code Not Present | CVE-2026-58045 is a defect in the Node.js runtime’s own zlib binding layer, not in the zlib library. The upstream fix (nodejs/node commit 0d072480c3dbbad6db8723e39786321646989343) changes only src/node_zlib.cc, replacing two CHECK(Buffer::IsWithinBounds(…)) assertions in CompressionStream::Write with THROW_ERR_OUT_OF_RANGE so a JavaScript object with a spoofed byteLength getter raises a RangeError instead of aborting the process; no zlib source file is touched. That the affected surface includes zlib.brotliCompressSync, zlib.brotliDecompressSync, zlib.zstdCompressSync, and zlib.zstdDecompressSync – codecs zlib does not implement – further confirms the defect lives in Node’s shared binding wrapper rather than in zlib. Document Filters is a C++ SDK with .NET/Python/Java bindings; it embeds no Node.js runtime, no V8, and no N-API/NAN addon, so the vulnerable CompressionStream::Write code and the V8 TypedArray spoofing primitive it depends on are not present in the tree at all (no node_zlib.cc, no Buffer::IsWithinBounds, no THROW_ERR_OUT_OF_RANGE). Document Filters calls zlib’s C API directly from shared/core/source/ISYScompressedstream.cpp and ISYSzipfile.cpp with buffer offsets and lengths it computes itself in native code, where no spoofable byteLength accessor exists. The only package.json in the repository (filters/tools/isys_readergen) is an internal build-time code generator depending solely on @types/node and commander; it is not shipped, does not use node:zlib, and no Node.js runtime is redistributed with the product. |
| 24.4.0 | zlib (1.3) | Not Affected | Code Not Present | CVE-2026-58045 is a defect in the Node.js runtime’s own zlib binding layer, not in the zlib library. The upstream fix (nodejs/node commit 0d072480c3dbbad6db8723e39786321646989343) changes only src/node_zlib.cc, replacing two CHECK(Buffer::IsWithinBounds(…)) assertions in CompressionStream::Write with THROW_ERR_OUT_OF_RANGE so a JavaScript object with a spoofed byteLength getter raises a RangeError instead of aborting the process; no zlib source file is touched. That the affected surface includes zlib.brotliCompressSync, zlib.brotliDecompressSync, zlib.zstdCompressSync, and zlib.zstdDecompressSync – codecs zlib does not implement – further confirms the defect lives in Node’s shared binding wrapper rather than in zlib. Document Filters is a C++ SDK with .NET/Python/Java bindings; it embeds no Node.js runtime, no V8, and no N-API/NAN addon, so the vulnerable CompressionStream::Write code and the V8 TypedArray spoofing primitive it depends on are not present in the tree at all (no node_zlib.cc, no Buffer::IsWithinBounds, no THROW_ERR_OUT_OF_RANGE). Document Filters calls zlib’s C API directly from shared/core/source/ISYScompressedstream.cpp and ISYSzipfile.cpp with buffer offsets and lengths it computes itself in native code, where no spoofable byteLength accessor exists. The only package.json in the repository (filters/tools/isys_readergen) is an internal build-time code generator depending solely on @types/node and commander; it is not shipped, does not use node:zlib, and no Node.js runtime is redistributed with the product. |
| 24.3 | zlib (1.3) | Not Affected | Code Not Present | CVE-2026-58045 is a defect in the Node.js runtime’s own zlib binding layer, not in the zlib library. The upstream fix (nodejs/node commit 0d072480c3dbbad6db8723e39786321646989343) changes only src/node_zlib.cc, replacing two CHECK(Buffer::IsWithinBounds(…)) assertions in CompressionStream::Write with THROW_ERR_OUT_OF_RANGE so a JavaScript object with a spoofed byteLength getter raises a RangeError instead of aborting the process; no zlib source file is touched. That the affected surface includes zlib.brotliCompressSync, zlib.brotliDecompressSync, zlib.zstdCompressSync, and zlib.zstdDecompressSync – codecs zlib does not implement – further confirms the defect lives in Node’s shared binding wrapper rather than in zlib. Document Filters is a C++ SDK with .NET/Python/Java bindings; it embeds no Node.js runtime, no V8, and no N-API/NAN addon, so the vulnerable CompressionStream::Write code and the V8 TypedArray spoofing primitive it depends on are not present in the tree at all (no node_zlib.cc, no Buffer::IsWithinBounds, no THROW_ERR_OUT_OF_RANGE). Document Filters calls zlib’s C API directly from shared/core/source/ISYScompressedstream.cpp and ISYSzipfile.cpp with buffer offsets and lengths it computes itself in native code, where no spoofable byteLength accessor exists. The only package.json in the repository (filters/tools/isys_readergen) is an internal build-time code generator depending solely on @types/node and commander; it is not shipped, does not use node:zlib, and no Node.js runtime is redistributed with the product. |
| 24.2 | zlib (1.3) | Not Affected | Code Not Present | CVE-2026-58045 is a defect in the Node.js runtime’s own zlib binding layer, not in the zlib library. The upstream fix (nodejs/node commit 0d072480c3dbbad6db8723e39786321646989343) changes only src/node_zlib.cc, replacing two CHECK(Buffer::IsWithinBounds(…)) assertions in CompressionStream::Write with THROW_ERR_OUT_OF_RANGE so a JavaScript object with a spoofed byteLength getter raises a RangeError instead of aborting the process; no zlib source file is touched. That the affected surface includes zlib.brotliCompressSync, zlib.brotliDecompressSync, zlib.zstdCompressSync, and zlib.zstdDecompressSync – codecs zlib does not implement – further confirms the defect lives in Node’s shared binding wrapper rather than in zlib. Document Filters is a C++ SDK with .NET/Python/Java bindings; it embeds no Node.js runtime, no V8, and no N-API/NAN addon, so the vulnerable CompressionStream::Write code and the V8 TypedArray spoofing primitive it depends on are not present in the tree at all (no node_zlib.cc, no Buffer::IsWithinBounds, no THROW_ERR_OUT_OF_RANGE). Document Filters calls zlib’s C API directly from shared/core/source/ISYScompressedstream.cpp and ISYSzipfile.cpp with buffer offsets and lengths it computes itself in native code, where no spoofable byteLength accessor exists. The only package.json in the repository (filters/tools/isys_readergen) is an internal build-time code generator depending solely on @types/node and commander; it is not shipped, does not use node:zlib, and no Node.js runtime is redistributed with the product. |
| 24.1 | zlib (1.3) | Not Affected | Code Not Present | CVE-2026-58045 is a defect in the Node.js runtime’s own zlib binding layer, not in the zlib library. The upstream fix (nodejs/node commit 0d072480c3dbbad6db8723e39786321646989343) changes only src/node_zlib.cc, replacing two CHECK(Buffer::IsWithinBounds(…)) assertions in CompressionStream::Write with THROW_ERR_OUT_OF_RANGE so a JavaScript object with a spoofed byteLength getter raises a RangeError instead of aborting the process; no zlib source file is touched. That the affected surface includes zlib.brotliCompressSync, zlib.brotliDecompressSync, zlib.zstdCompressSync, and zlib.zstdDecompressSync – codecs zlib does not implement – further confirms the defect lives in Node’s shared binding wrapper rather than in zlib. Document Filters is a C++ SDK with .NET/Python/Java bindings; it embeds no Node.js runtime, no V8, and no N-API/NAN addon, so the vulnerable CompressionStream::Write code and the V8 TypedArray spoofing primitive it depends on are not present in the tree at all (no node_zlib.cc, no Buffer::IsWithinBounds, no THROW_ERR_OUT_OF_RANGE). Document Filters calls zlib’s C API directly from shared/core/source/ISYScompressedstream.cpp and ISYSzipfile.cpp with buffer offsets and lengths it computes itself in native code, where no spoofable byteLength accessor exists. The only package.json in the repository (filters/tools/isys_readergen) is an internal build-time code generator depending solely on @types/node and commander; it is not shipped, does not use node:zlib, and no Node.js runtime is redistributed with the product. |
| 23.3 | zlib (1.3) | Not Affected | Code Not Present | CVE-2026-58045 is a defect in the Node.js runtime’s own zlib binding layer, not in the zlib library. The upstream fix (nodejs/node commit 0d072480c3dbbad6db8723e39786321646989343) changes only src/node_zlib.cc, replacing two CHECK(Buffer::IsWithinBounds(…)) assertions in CompressionStream::Write with THROW_ERR_OUT_OF_RANGE so a JavaScript object with a spoofed byteLength getter raises a RangeError instead of aborting the process; no zlib source file is touched. That the affected surface includes zlib.brotliCompressSync, zlib.brotliDecompressSync, zlib.zstdCompressSync, and zlib.zstdDecompressSync – codecs zlib does not implement – further confirms the defect lives in Node’s shared binding wrapper rather than in zlib. Document Filters is a C++ SDK with .NET/Python/Java bindings; it embeds no Node.js runtime, no V8, and no N-API/NAN addon, so the vulnerable CompressionStream::Write code and the V8 TypedArray spoofing primitive it depends on are not present in the tree at all (no node_zlib.cc, no Buffer::IsWithinBounds, no THROW_ERR_OUT_OF_RANGE). Document Filters calls zlib’s C API directly from shared/core/source/ISYScompressedstream.cpp and ISYSzipfile.cpp with buffer offsets and lengths it computes itself in native code, where no spoofable byteLength accessor exists. The only package.json in the repository (filters/tools/isys_readergen) is an internal build-time code generator depending solely on @types/node and commander; it is not shipped, does not use node:zlib, and no Node.js runtime is redistributed with the product. |
| 23.2 | zlib (1.2.12) | Not Affected | Code Not Present | CVE-2026-58045 is a defect in the Node.js runtime’s own zlib binding layer, not in the zlib library. The upstream fix (nodejs/node commit 0d072480c3dbbad6db8723e39786321646989343) changes only src/node_zlib.cc, replacing two CHECK(Buffer::IsWithinBounds(…)) assertions in CompressionStream::Write with THROW_ERR_OUT_OF_RANGE so a JavaScript object with a spoofed byteLength getter raises a RangeError instead of aborting the process; no zlib source file is touched. That the affected surface includes zlib.brotliCompressSync, zlib.brotliDecompressSync, zlib.zstdCompressSync, and zlib.zstdDecompressSync – codecs zlib does not implement – further confirms the defect lives in Node’s shared binding wrapper rather than in zlib. Document Filters is a C++ SDK with .NET/Python/Java bindings; it embeds no Node.js runtime, no V8, and no N-API/NAN addon, so the vulnerable CompressionStream::Write code and the V8 TypedArray spoofing primitive it depends on are not present in the tree at all (no node_zlib.cc, no Buffer::IsWithinBounds, no THROW_ERR_OUT_OF_RANGE). Document Filters calls zlib’s C API directly from shared/core/source/ISYScompressedstream.cpp and ISYSzipfile.cpp with buffer offsets and lengths it computes itself in native code, where no spoofable byteLength accessor exists. The only package.json in the repository (filters/tools/isys_readergen) is an internal build-time code generator depending solely on @types/node and commander; it is not shipped, does not use node:zlib, and no Node.js runtime is redistributed with the product. |
| 23.1 | zlib (1.2.12) | Not Affected | Code Not Present | CVE-2026-58045 is a defect in the Node.js runtime’s own zlib binding layer, not in the zlib library. The upstream fix (nodejs/node commit 0d072480c3dbbad6db8723e39786321646989343) changes only src/node_zlib.cc, replacing two CHECK(Buffer::IsWithinBounds(…)) assertions in CompressionStream::Write with THROW_ERR_OUT_OF_RANGE so a JavaScript object with a spoofed byteLength getter raises a RangeError instead of aborting the process; no zlib source file is touched. That the affected surface includes zlib.brotliCompressSync, zlib.brotliDecompressSync, zlib.zstdCompressSync, and zlib.zstdDecompressSync – codecs zlib does not implement – further confirms the defect lives in Node’s shared binding wrapper rather than in zlib. Document Filters is a C++ SDK with .NET/Python/Java bindings; it embeds no Node.js runtime, no V8, and no N-API/NAN addon, so the vulnerable CompressionStream::Write code and the V8 TypedArray spoofing primitive it depends on are not present in the tree at all (no node_zlib.cc, no Buffer::IsWithinBounds, no THROW_ERR_OUT_OF_RANGE). Document Filters calls zlib’s C API directly from shared/core/source/ISYScompressedstream.cpp and ISYSzipfile.cpp with buffer offsets and lengths it computes itself in native code, where no spoofable byteLength accessor exists. The only package.json in the repository (filters/tools/isys_readergen) is an internal build-time code generator depending solely on @types/node and commander; it is not shipped, does not use node:zlib, and no Node.js runtime is redistributed with the product. |
| 22.4 | zlib (1.2.12) | Not Affected | Code Not Present | CVE-2026-58045 is a defect in the Node.js runtime’s own zlib binding layer, not in the zlib library. The upstream fix (nodejs/node commit 0d072480c3dbbad6db8723e39786321646989343) changes only src/node_zlib.cc, replacing two CHECK(Buffer::IsWithinBounds(…)) assertions in CompressionStream::Write with THROW_ERR_OUT_OF_RANGE so a JavaScript object with a spoofed byteLength getter raises a RangeError instead of aborting the process; no zlib source file is touched. That the affected surface includes zlib.brotliCompressSync, zlib.brotliDecompressSync, zlib.zstdCompressSync, and zlib.zstdDecompressSync – codecs zlib does not implement – further confirms the defect lives in Node’s shared binding wrapper rather than in zlib. Document Filters is a C++ SDK with .NET/Python/Java bindings; it embeds no Node.js runtime, no V8, and no N-API/NAN addon, so the vulnerable CompressionStream::Write code and the V8 TypedArray spoofing primitive it depends on are not present in the tree at all (no node_zlib.cc, no Buffer::IsWithinBounds, no THROW_ERR_OUT_OF_RANGE). Document Filters calls zlib’s C API directly from shared/core/source/ISYScompressedstream.cpp and ISYSzipfile.cpp with buffer offsets and lengths it computes itself in native code, where no spoofable byteLength accessor exists. The only package.json in the repository (filters/tools/isys_readergen) is an internal build-time code generator depending solely on @types/node and commander; it is not shipped, does not use node:zlib, and no Node.js runtime is redistributed with the product. |
| 22.3 | zlib (1.2.12) | Not Affected | Code Not Present | CVE-2026-58045 is a defect in the Node.js runtime’s own zlib binding layer, not in the zlib library. The upstream fix (nodejs/node commit 0d072480c3dbbad6db8723e39786321646989343) changes only src/node_zlib.cc, replacing two CHECK(Buffer::IsWithinBounds(…)) assertions in CompressionStream::Write with THROW_ERR_OUT_OF_RANGE so a JavaScript object with a spoofed byteLength getter raises a RangeError instead of aborting the process; no zlib source file is touched. That the affected surface includes zlib.brotliCompressSync, zlib.brotliDecompressSync, zlib.zstdCompressSync, and zlib.zstdDecompressSync – codecs zlib does not implement – further confirms the defect lives in Node’s shared binding wrapper rather than in zlib. Document Filters is a C++ SDK with .NET/Python/Java bindings; it embeds no Node.js runtime, no V8, and no N-API/NAN addon, so the vulnerable CompressionStream::Write code and the V8 TypedArray spoofing primitive it depends on are not present in the tree at all (no node_zlib.cc, no Buffer::IsWithinBounds, no THROW_ERR_OUT_OF_RANGE). Document Filters calls zlib’s C API directly from shared/core/source/ISYScompressedstream.cpp and ISYSzipfile.cpp with buffer offsets and lengths it computes itself in native code, where no spoofable byteLength accessor exists. The only package.json in the repository (filters/tools/isys_readergen) is an internal build-time code generator depending solely on @types/node and commander; it is not shipped, does not use node:zlib, and no Node.js runtime is redistributed with the product. |
| 22.2 | zlib (1.2.12) | Not Affected | Code Not Present | CVE-2026-58045 is a defect in the Node.js runtime’s own zlib binding layer, not in the zlib library. The upstream fix (nodejs/node commit 0d072480c3dbbad6db8723e39786321646989343) changes only src/node_zlib.cc, replacing two CHECK(Buffer::IsWithinBounds(…)) assertions in CompressionStream::Write with THROW_ERR_OUT_OF_RANGE so a JavaScript object with a spoofed byteLength getter raises a RangeError instead of aborting the process; no zlib source file is touched. That the affected surface includes zlib.brotliCompressSync, zlib.brotliDecompressSync, zlib.zstdCompressSync, and zlib.zstdDecompressSync – codecs zlib does not implement – further confirms the defect lives in Node’s shared binding wrapper rather than in zlib. Document Filters is a C++ SDK with .NET/Python/Java bindings; it embeds no Node.js runtime, no V8, and no N-API/NAN addon, so the vulnerable CompressionStream::Write code and the V8 TypedArray spoofing primitive it depends on are not present in the tree at all (no node_zlib.cc, no Buffer::IsWithinBounds, no THROW_ERR_OUT_OF_RANGE). Document Filters calls zlib’s C API directly from shared/core/source/ISYScompressedstream.cpp and ISYSzipfile.cpp with buffer offsets and lengths it computes itself in native code, where no spoofable byteLength accessor exists. The only package.json in the repository (filters/tools/isys_readergen) is an internal build-time code generator depending solely on @types/node and commander; it is not shipped, does not use node:zlib, and no Node.js runtime is redistributed with the product. |
| 22.1 | zlib (1.2.11) | Not Affected | Code Not Present | CVE-2026-58045 is a defect in the Node.js runtime’s own zlib binding layer, not in the zlib library. The upstream fix (nodejs/node commit 0d072480c3dbbad6db8723e39786321646989343) changes only src/node_zlib.cc, replacing two CHECK(Buffer::IsWithinBounds(…)) assertions in CompressionStream::Write with THROW_ERR_OUT_OF_RANGE so a JavaScript object with a spoofed byteLength getter raises a RangeError instead of aborting the process; no zlib source file is touched. That the affected surface includes zlib.brotliCompressSync, zlib.brotliDecompressSync, zlib.zstdCompressSync, and zlib.zstdDecompressSync – codecs zlib does not implement – further confirms the defect lives in Node’s shared binding wrapper rather than in zlib. Document Filters is a C++ SDK with .NET/Python/Java bindings; it embeds no Node.js runtime, no V8, and no N-API/NAN addon, so the vulnerable CompressionStream::Write code and the V8 TypedArray spoofing primitive it depends on are not present in the tree at all (no node_zlib.cc, no Buffer::IsWithinBounds, no THROW_ERR_OUT_OF_RANGE). Document Filters calls zlib’s C API directly from shared/core/source/ISYScompressedstream.cpp and ISYSzipfile.cpp with buffer offsets and lengths it computes itself in native code, where no spoofable byteLength accessor exists. The only package.json in the repository (filters/tools/isys_readergen) is an internal build-time code generator depending solely on @types/node and commander; it is not shipped, does not use node:zlib, and no Node.js runtime is redistributed with the product. |
| 21.11 | zlib (1.2.11) | Not Affected | Code Not Present | CVE-2026-58045 is a defect in the Node.js runtime’s own zlib binding layer, not in the zlib library. The upstream fix (nodejs/node commit 0d072480c3dbbad6db8723e39786321646989343) changes only src/node_zlib.cc, replacing two CHECK(Buffer::IsWithinBounds(…)) assertions in CompressionStream::Write with THROW_ERR_OUT_OF_RANGE so a JavaScript object with a spoofed byteLength getter raises a RangeError instead of aborting the process; no zlib source file is touched. That the affected surface includes zlib.brotliCompressSync, zlib.brotliDecompressSync, zlib.zstdCompressSync, and zlib.zstdDecompressSync – codecs zlib does not implement – further confirms the defect lives in Node’s shared binding wrapper rather than in zlib. Document Filters is a C++ SDK with .NET/Python/Java bindings; it embeds no Node.js runtime, no V8, and no N-API/NAN addon, so the vulnerable CompressionStream::Write code and the V8 TypedArray spoofing primitive it depends on are not present in the tree at all (no node_zlib.cc, no Buffer::IsWithinBounds, no THROW_ERR_OUT_OF_RANGE). Document Filters calls zlib’s C API directly from shared/core/source/ISYScompressedstream.cpp and ISYSzipfile.cpp with buffer offsets and lengths it computes itself in native code, where no spoofable byteLength accessor exists. The only package.json in the repository (filters/tools/isys_readergen) is an internal build-time code generator depending solely on @types/node and commander; it is not shipped, does not use node:zlib, and no Node.js runtime is redistributed with the product. |
| 21.8 | zlib (1.2.11) | Not Affected | Code Not Present | CVE-2026-58045 is a defect in the Node.js runtime’s own zlib binding layer, not in the zlib library. The upstream fix (nodejs/node commit 0d072480c3dbbad6db8723e39786321646989343) changes only src/node_zlib.cc, replacing two CHECK(Buffer::IsWithinBounds(…)) assertions in CompressionStream::Write with THROW_ERR_OUT_OF_RANGE so a JavaScript object with a spoofed byteLength getter raises a RangeError instead of aborting the process; no zlib source file is touched. That the affected surface includes zlib.brotliCompressSync, zlib.brotliDecompressSync, zlib.zstdCompressSync, and zlib.zstdDecompressSync – codecs zlib does not implement – further confirms the defect lives in Node’s shared binding wrapper rather than in zlib. Document Filters is a C++ SDK with .NET/Python/Java bindings; it embeds no Node.js runtime, no V8, and no N-API/NAN addon, so the vulnerable CompressionStream::Write code and the V8 TypedArray spoofing primitive it depends on are not present in the tree at all (no node_zlib.cc, no Buffer::IsWithinBounds, no THROW_ERR_OUT_OF_RANGE). Document Filters calls zlib’s C API directly from shared/core/source/ISYScompressedstream.cpp and ISYSzipfile.cpp with buffer offsets and lengths it computes itself in native code, where no spoofable byteLength accessor exists. The only package.json in the repository (filters/tools/isys_readergen) is an internal build-time code generator depending solely on @types/node and commander; it is not shipped, does not use node:zlib, and no Node.js runtime is redistributed with the product. |
| 21.5.0 | zlib (1.2.11) | Not Affected | Code Not Present | CVE-2026-58045 is a defect in the Node.js runtime’s own zlib binding layer, not in the zlib library. The upstream fix (nodejs/node commit 0d072480c3dbbad6db8723e39786321646989343) changes only src/node_zlib.cc, replacing two CHECK(Buffer::IsWithinBounds(…)) assertions in CompressionStream::Write with THROW_ERR_OUT_OF_RANGE so a JavaScript object with a spoofed byteLength getter raises a RangeError instead of aborting the process; no zlib source file is touched. That the affected surface includes zlib.brotliCompressSync, zlib.brotliDecompressSync, zlib.zstdCompressSync, and zlib.zstdDecompressSync – codecs zlib does not implement – further confirms the defect lives in Node’s shared binding wrapper rather than in zlib. Document Filters is a C++ SDK with .NET/Python/Java bindings; it embeds no Node.js runtime, no V8, and no N-API/NAN addon, so the vulnerable CompressionStream::Write code and the V8 TypedArray spoofing primitive it depends on are not present in the tree at all (no node_zlib.cc, no Buffer::IsWithinBounds, no THROW_ERR_OUT_OF_RANGE). Document Filters calls zlib’s C API directly from shared/core/source/ISYScompressedstream.cpp and ISYSzipfile.cpp with buffer offsets and lengths it computes itself in native code, where no spoofable byteLength accessor exists. The only package.json in the repository (filters/tools/isys_readergen) is an internal build-time code generator depending solely on @types/node and commander; it is not shipped, does not use node:zlib, and no Node.js runtime is redistributed with the product. |
| 21.2.0 | zlib (1.2.11) | Not Affected | Code Not Present | CVE-2026-58045 is a defect in the Node.js runtime’s own zlib binding layer, not in the zlib library. The upstream fix (nodejs/node commit 0d072480c3dbbad6db8723e39786321646989343) changes only src/node_zlib.cc, replacing two CHECK(Buffer::IsWithinBounds(…)) assertions in CompressionStream::Write with THROW_ERR_OUT_OF_RANGE so a JavaScript object with a spoofed byteLength getter raises a RangeError instead of aborting the process; no zlib source file is touched. That the affected surface includes zlib.brotliCompressSync, zlib.brotliDecompressSync, zlib.zstdCompressSync, and zlib.zstdDecompressSync – codecs zlib does not implement – further confirms the defect lives in Node’s shared binding wrapper rather than in zlib. Document Filters is a C++ SDK with .NET/Python/Java bindings; it embeds no Node.js runtime, no V8, and no N-API/NAN addon, so the vulnerable CompressionStream::Write code and the V8 TypedArray spoofing primitive it depends on are not present in the tree at all (no node_zlib.cc, no Buffer::IsWithinBounds, no THROW_ERR_OUT_OF_RANGE). Document Filters calls zlib’s C API directly from shared/core/source/ISYScompressedstream.cpp and ISYSzipfile.cpp with buffer offsets and lengths it computes itself in native code, where no spoofable byteLength accessor exists. The only package.json in the repository (filters/tools/isys_readergen) is an internal build-time code generator depending solely on @types/node and commander; it is not shipped, does not use node:zlib, and no Node.js runtime is redistributed with the product. |
| 11.4.19.3667 | zlib (1.2.11) | Not Affected | Code Not Present | CVE-2026-58045 is a defect in the Node.js runtime’s own zlib binding layer, not in the zlib library. The upstream fix (nodejs/node commit 0d072480c3dbbad6db8723e39786321646989343) changes only src/node_zlib.cc, replacing two CHECK(Buffer::IsWithinBounds(…)) assertions in CompressionStream::Write with THROW_ERR_OUT_OF_RANGE so a JavaScript object with a spoofed byteLength getter raises a RangeError instead of aborting the process; no zlib source file is touched. That the affected surface includes zlib.brotliCompressSync, zlib.brotliDecompressSync, zlib.zstdCompressSync, and zlib.zstdDecompressSync – codecs zlib does not implement – further confirms the defect lives in Node’s shared binding wrapper rather than in zlib. Document Filters is a C++ SDK with .NET/Python/Java bindings; it embeds no Node.js runtime, no V8, and no N-API/NAN addon, so the vulnerable CompressionStream::Write code and the V8 TypedArray spoofing primitive it depends on are not present in the tree at all (no node_zlib.cc, no Buffer::IsWithinBounds, no THROW_ERR_OUT_OF_RANGE). Document Filters calls zlib’s C API directly from shared/core/source/ISYScompressedstream.cpp and ISYSzipfile.cpp with buffer offsets and lengths it computes itself in native code, where no spoofable byteLength accessor exists. The only package.json in the repository (filters/tools/isys_readergen) is an internal build-time code generator depending solely on @types/node and commander; it is not shipped, does not use node:zlib, and no Node.js runtime is redistributed with the product. |
| 11.4.18.3599 | zlib (1.2.11) | Not Affected | Code Not Present | CVE-2026-58045 is a defect in the Node.js runtime’s own zlib binding layer, not in the zlib library. The upstream fix (nodejs/node commit 0d072480c3dbbad6db8723e39786321646989343) changes only src/node_zlib.cc, replacing two CHECK(Buffer::IsWithinBounds(…)) assertions in CompressionStream::Write with THROW_ERR_OUT_OF_RANGE so a JavaScript object with a spoofed byteLength getter raises a RangeError instead of aborting the process; no zlib source file is touched. That the affected surface includes zlib.brotliCompressSync, zlib.brotliDecompressSync, zlib.zstdCompressSync, and zlib.zstdDecompressSync – codecs zlib does not implement – further confirms the defect lives in Node’s shared binding wrapper rather than in zlib. Document Filters is a C++ SDK with .NET/Python/Java bindings; it embeds no Node.js runtime, no V8, and no N-API/NAN addon, so the vulnerable CompressionStream::Write code and the V8 TypedArray spoofing primitive it depends on are not present in the tree at all (no node_zlib.cc, no Buffer::IsWithinBounds, no THROW_ERR_OUT_OF_RANGE). Document Filters calls zlib’s C API directly from shared/core/source/ISYScompressedstream.cpp and ISYSzipfile.cpp with buffer offsets and lengths it computes itself in native code, where no spoofable byteLength accessor exists. The only package.json in the repository (filters/tools/isys_readergen) is an internal build-time code generator depending solely on @types/node and commander; it is not shipped, does not use node:zlib, and no Node.js runtime is redistributed with the product. |
| 11.4.16.3445 | zlib (1.2.11) | Not Affected | Code Not Present | CVE-2026-58045 is a defect in the Node.js runtime’s own zlib binding layer, not in the zlib library. The upstream fix (nodejs/node commit 0d072480c3dbbad6db8723e39786321646989343) changes only src/node_zlib.cc, replacing two CHECK(Buffer::IsWithinBounds(…)) assertions in CompressionStream::Write with THROW_ERR_OUT_OF_RANGE so a JavaScript object with a spoofed byteLength getter raises a RangeError instead of aborting the process; no zlib source file is touched. That the affected surface includes zlib.brotliCompressSync, zlib.brotliDecompressSync, zlib.zstdCompressSync, and zlib.zstdDecompressSync – codecs zlib does not implement – further confirms the defect lives in Node’s shared binding wrapper rather than in zlib. Document Filters is a C++ SDK with .NET/Python/Java bindings; it embeds no Node.js runtime, no V8, and no N-API/NAN addon, so the vulnerable CompressionStream::Write code and the V8 TypedArray spoofing primitive it depends on are not present in the tree at all (no node_zlib.cc, no Buffer::IsWithinBounds, no THROW_ERR_OUT_OF_RANGE). Document Filters calls zlib’s C API directly from shared/core/source/ISYScompressedstream.cpp and ISYSzipfile.cpp with buffer offsets and lengths it computes itself in native code, where no spoofable byteLength accessor exists. The only package.json in the repository (filters/tools/isys_readergen) is an internal build-time code generator depending solely on @types/node and commander; it is not shipped, does not use node:zlib, and no Node.js runtime is redistributed with the product. |
| 11.4.15.3368 | zlib (1.2.11) | Not Affected | Code Not Present | CVE-2026-58045 is a defect in the Node.js runtime’s own zlib binding layer, not in the zlib library. The upstream fix (nodejs/node commit 0d072480c3dbbad6db8723e39786321646989343) changes only src/node_zlib.cc, replacing two CHECK(Buffer::IsWithinBounds(…)) assertions in CompressionStream::Write with THROW_ERR_OUT_OF_RANGE so a JavaScript object with a spoofed byteLength getter raises a RangeError instead of aborting the process; no zlib source file is touched. That the affected surface includes zlib.brotliCompressSync, zlib.brotliDecompressSync, zlib.zstdCompressSync, and zlib.zstdDecompressSync – codecs zlib does not implement – further confirms the defect lives in Node’s shared binding wrapper rather than in zlib. Document Filters is a C++ SDK with .NET/Python/Java bindings; it embeds no Node.js runtime, no V8, and no N-API/NAN addon, so the vulnerable CompressionStream::Write code and the V8 TypedArray spoofing primitive it depends on are not present in the tree at all (no node_zlib.cc, no Buffer::IsWithinBounds, no THROW_ERR_OUT_OF_RANGE). Document Filters calls zlib’s C API directly from shared/core/source/ISYScompressedstream.cpp and ISYSzipfile.cpp with buffer offsets and lengths it computes itself in native code, where no spoofable byteLength accessor exists. The only package.json in the repository (filters/tools/isys_readergen) is an internal build-time code generator depending solely on @types/node and commander; it is not shipped, does not use node:zlib, and no Node.js runtime is redistributed with the product. |
| 11.4.14.3263 | zlib (1.2.11) | Not Affected | Code Not Present | CVE-2026-58045 is a defect in the Node.js runtime’s own zlib binding layer, not in the zlib library. The upstream fix (nodejs/node commit 0d072480c3dbbad6db8723e39786321646989343) changes only src/node_zlib.cc, replacing two CHECK(Buffer::IsWithinBounds(…)) assertions in CompressionStream::Write with THROW_ERR_OUT_OF_RANGE so a JavaScript object with a spoofed byteLength getter raises a RangeError instead of aborting the process; no zlib source file is touched. That the affected surface includes zlib.brotliCompressSync, zlib.brotliDecompressSync, zlib.zstdCompressSync, and zlib.zstdDecompressSync – codecs zlib does not implement – further confirms the defect lives in Node’s shared binding wrapper rather than in zlib. Document Filters is a C++ SDK with .NET/Python/Java bindings; it embeds no Node.js runtime, no V8, and no N-API/NAN addon, so the vulnerable CompressionStream::Write code and the V8 TypedArray spoofing primitive it depends on are not present in the tree at all (no node_zlib.cc, no Buffer::IsWithinBounds, no THROW_ERR_OUT_OF_RANGE). Document Filters calls zlib’s C API directly from shared/core/source/ISYScompressedstream.cpp and ISYSzipfile.cpp with buffer offsets and lengths it computes itself in native code, where no spoofable byteLength accessor exists. The only package.json in the repository (filters/tools/isys_readergen) is an internal build-time code generator depending solely on @types/node and commander; it is not shipped, does not use node:zlib, and no Node.js runtime is redistributed with the product. |
| 11.4.13.3179 | zlib (1.2.11) | Not Affected | Code Not Present | CVE-2026-58045 is a defect in the Node.js runtime’s own zlib binding layer, not in the zlib library. The upstream fix (nodejs/node commit 0d072480c3dbbad6db8723e39786321646989343) changes only src/node_zlib.cc, replacing two CHECK(Buffer::IsWithinBounds(…)) assertions in CompressionStream::Write with THROW_ERR_OUT_OF_RANGE so a JavaScript object with a spoofed byteLength getter raises a RangeError instead of aborting the process; no zlib source file is touched. That the affected surface includes zlib.brotliCompressSync, zlib.brotliDecompressSync, zlib.zstdCompressSync, and zlib.zstdDecompressSync – codecs zlib does not implement – further confirms the defect lives in Node’s shared binding wrapper rather than in zlib. Document Filters is a C++ SDK with .NET/Python/Java bindings; it embeds no Node.js runtime, no V8, and no N-API/NAN addon, so the vulnerable CompressionStream::Write code and the V8 TypedArray spoofing primitive it depends on are not present in the tree at all (no node_zlib.cc, no Buffer::IsWithinBounds, no THROW_ERR_OUT_OF_RANGE). Document Filters calls zlib’s C API directly from shared/core/source/ISYScompressedstream.cpp and ISYSzipfile.cpp with buffer offsets and lengths it computes itself in native code, where no spoofable byteLength accessor exists. The only package.json in the repository (filters/tools/isys_readergen) is an internal build-time code generator depending solely on @types/node and commander; it is not shipped, does not use node:zlib, and no Node.js runtime is redistributed with the product. |
| 11.4.12.3054 | zlib (1.2.11) | Not Affected | Code Not Present | CVE-2026-58045 is a defect in the Node.js runtime’s own zlib binding layer, not in the zlib library. The upstream fix (nodejs/node commit 0d072480c3dbbad6db8723e39786321646989343) changes only src/node_zlib.cc, replacing two CHECK(Buffer::IsWithinBounds(…)) assertions in CompressionStream::Write with THROW_ERR_OUT_OF_RANGE so a JavaScript object with a spoofed byteLength getter raises a RangeError instead of aborting the process; no zlib source file is touched. That the affected surface includes zlib.brotliCompressSync, zlib.brotliDecompressSync, zlib.zstdCompressSync, and zlib.zstdDecompressSync – codecs zlib does not implement – further confirms the defect lives in Node’s shared binding wrapper rather than in zlib. Document Filters is a C++ SDK with .NET/Python/Java bindings; it embeds no Node.js runtime, no V8, and no N-API/NAN addon, so the vulnerable CompressionStream::Write code and the V8 TypedArray spoofing primitive it depends on are not present in the tree at all (no node_zlib.cc, no Buffer::IsWithinBounds, no THROW_ERR_OUT_OF_RANGE). Document Filters calls zlib’s C API directly from shared/core/source/ISYScompressedstream.cpp and ISYSzipfile.cpp with buffer offsets and lengths it computes itself in native code, where no spoofable byteLength accessor exists. The only package.json in the repository (filters/tools/isys_readergen) is an internal build-time code generator depending solely on @types/node and commander; it is not shipped, does not use node:zlib, and no Node.js runtime is redistributed with the product. |
| 11.4.11.3040 | zlib (1.2.11) | Not Affected | Code Not Present | CVE-2026-58045 is a defect in the Node.js runtime’s own zlib binding layer, not in the zlib library. The upstream fix (nodejs/node commit 0d072480c3dbbad6db8723e39786321646989343) changes only src/node_zlib.cc, replacing two CHECK(Buffer::IsWithinBounds(…)) assertions in CompressionStream::Write with THROW_ERR_OUT_OF_RANGE so a JavaScript object with a spoofed byteLength getter raises a RangeError instead of aborting the process; no zlib source file is touched. That the affected surface includes zlib.brotliCompressSync, zlib.brotliDecompressSync, zlib.zstdCompressSync, and zlib.zstdDecompressSync – codecs zlib does not implement – further confirms the defect lives in Node’s shared binding wrapper rather than in zlib. Document Filters is a C++ SDK with .NET/Python/Java bindings; it embeds no Node.js runtime, no V8, and no N-API/NAN addon, so the vulnerable CompressionStream::Write code and the V8 TypedArray spoofing primitive it depends on are not present in the tree at all (no node_zlib.cc, no Buffer::IsWithinBounds, no THROW_ERR_OUT_OF_RANGE). Document Filters calls zlib’s C API directly from shared/core/source/ISYScompressedstream.cpp and ISYSzipfile.cpp with buffer offsets and lengths it computes itself in native code, where no spoofable byteLength accessor exists. The only package.json in the repository (filters/tools/isys_readergen) is an internal build-time code generator depending solely on @types/node and commander; it is not shipped, does not use node:zlib, and no Node.js runtime is redistributed with the product. |
| 11.4.11.2990 | zlib (1.2.11) | Not Affected | Code Not Present | CVE-2026-58045 is a defect in the Node.js runtime’s own zlib binding layer, not in the zlib library. The upstream fix (nodejs/node commit 0d072480c3dbbad6db8723e39786321646989343) changes only src/node_zlib.cc, replacing two CHECK(Buffer::IsWithinBounds(…)) assertions in CompressionStream::Write with THROW_ERR_OUT_OF_RANGE so a JavaScript object with a spoofed byteLength getter raises a RangeError instead of aborting the process; no zlib source file is touched. That the affected surface includes zlib.brotliCompressSync, zlib.brotliDecompressSync, zlib.zstdCompressSync, and zlib.zstdDecompressSync – codecs zlib does not implement – further confirms the defect lives in Node’s shared binding wrapper rather than in zlib. Document Filters is a C++ SDK with .NET/Python/Java bindings; it embeds no Node.js runtime, no V8, and no N-API/NAN addon, so the vulnerable CompressionStream::Write code and the V8 TypedArray spoofing primitive it depends on are not present in the tree at all (no node_zlib.cc, no Buffer::IsWithinBounds, no THROW_ERR_OUT_OF_RANGE). Document Filters calls zlib’s C API directly from shared/core/source/ISYScompressedstream.cpp and ISYSzipfile.cpp with buffer offsets and lengths it computes itself in native code, where no spoofable byteLength accessor exists. The only package.json in the repository (filters/tools/isys_readergen) is an internal build-time code generator depending solely on @types/node and commander; it is not shipped, does not use node:zlib, and no Node.js runtime is redistributed with the product. |
| 11.4.10.2934 | zlib (1.2.11) | Not Affected | Code Not Present | CVE-2026-58045 is a defect in the Node.js runtime’s own zlib binding layer, not in the zlib library. The upstream fix (nodejs/node commit 0d072480c3dbbad6db8723e39786321646989343) changes only src/node_zlib.cc, replacing two CHECK(Buffer::IsWithinBounds(…)) assertions in CompressionStream::Write with THROW_ERR_OUT_OF_RANGE so a JavaScript object with a spoofed byteLength getter raises a RangeError instead of aborting the process; no zlib source file is touched. That the affected surface includes zlib.brotliCompressSync, zlib.brotliDecompressSync, zlib.zstdCompressSync, and zlib.zstdDecompressSync – codecs zlib does not implement – further confirms the defect lives in Node’s shared binding wrapper rather than in zlib. Document Filters is a C++ SDK with .NET/Python/Java bindings; it embeds no Node.js runtime, no V8, and no N-API/NAN addon, so the vulnerable CompressionStream::Write code and the V8 TypedArray spoofing primitive it depends on are not present in the tree at all (no node_zlib.cc, no Buffer::IsWithinBounds, no THROW_ERR_OUT_OF_RANGE). Document Filters calls zlib’s C API directly from shared/core/source/ISYScompressedstream.cpp and ISYSzipfile.cpp with buffer offsets and lengths it computes itself in native code, where no spoofable byteLength accessor exists. The only package.json in the repository (filters/tools/isys_readergen) is an internal build-time code generator depending solely on @types/node and commander; it is not shipped, does not use node:zlib, and no Node.js runtime is redistributed with the product. |
| 11.4.9.2878 | zlib (1.2.11) | Not Affected | Code Not Present | CVE-2026-58045 is a defect in the Node.js runtime’s own zlib binding layer, not in the zlib library. The upstream fix (nodejs/node commit 0d072480c3dbbad6db8723e39786321646989343) changes only src/node_zlib.cc, replacing two CHECK(Buffer::IsWithinBounds(…)) assertions in CompressionStream::Write with THROW_ERR_OUT_OF_RANGE so a JavaScript object with a spoofed byteLength getter raises a RangeError instead of aborting the process; no zlib source file is touched. That the affected surface includes zlib.brotliCompressSync, zlib.brotliDecompressSync, zlib.zstdCompressSync, and zlib.zstdDecompressSync – codecs zlib does not implement – further confirms the defect lives in Node’s shared binding wrapper rather than in zlib. Document Filters is a C++ SDK with .NET/Python/Java bindings; it embeds no Node.js runtime, no V8, and no N-API/NAN addon, so the vulnerable CompressionStream::Write code and the V8 TypedArray spoofing primitive it depends on are not present in the tree at all (no node_zlib.cc, no Buffer::IsWithinBounds, no THROW_ERR_OUT_OF_RANGE). Document Filters calls zlib’s C API directly from shared/core/source/ISYScompressedstream.cpp and ISYSzipfile.cpp with buffer offsets and lengths it computes itself in native code, where no spoofable byteLength accessor exists. The only package.json in the repository (filters/tools/isys_readergen) is an internal build-time code generator depending solely on @types/node and commander; it is not shipped, does not use node:zlib, and no Node.js runtime is redistributed with the product. |
| 11.4.8.2822 | zlib (1.2.11) | Not Affected | Code Not Present | CVE-2026-58045 is a defect in the Node.js runtime’s own zlib binding layer, not in the zlib library. The upstream fix (nodejs/node commit 0d072480c3dbbad6db8723e39786321646989343) changes only src/node_zlib.cc, replacing two CHECK(Buffer::IsWithinBounds(…)) assertions in CompressionStream::Write with THROW_ERR_OUT_OF_RANGE so a JavaScript object with a spoofed byteLength getter raises a RangeError instead of aborting the process; no zlib source file is touched. That the affected surface includes zlib.brotliCompressSync, zlib.brotliDecompressSync, zlib.zstdCompressSync, and zlib.zstdDecompressSync – codecs zlib does not implement – further confirms the defect lives in Node’s shared binding wrapper rather than in zlib. Document Filters is a C++ SDK with .NET/Python/Java bindings; it embeds no Node.js runtime, no V8, and no N-API/NAN addon, so the vulnerable CompressionStream::Write code and the V8 TypedArray spoofing primitive it depends on are not present in the tree at all (no node_zlib.cc, no Buffer::IsWithinBounds, no THROW_ERR_OUT_OF_RANGE). Document Filters calls zlib’s C API directly from shared/core/source/ISYScompressedstream.cpp and ISYSzipfile.cpp with buffer offsets and lengths it computes itself in native code, where no spoofable byteLength accessor exists. The only package.json in the repository (filters/tools/isys_readergen) is an internal build-time code generator depending solely on @types/node and commander; it is not shipped, does not use node:zlib, and no Node.js runtime is redistributed with the product. |
Severity score breakdown
Attack Complexity
LOW
Attack Vector
LOCAL
Availability Impact
HIGH
Base Score
6.2
Base Severity
MEDIUM
Confidentiality Impact
NONE
Integrity Impact
NONE
Privileges Required
NONE
Scope
UNCHANGED
User Interaction
NONE
Vector String
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Version
3.0