Node.js zlib CVE-2026-58045

The vulnerability resides in Node.js's built-in zlib module, which wraps the native zlib C library to provide deflate, inflate, gzip, brotli, and related compression stream operations used widely across the Node.js ecosystem. CWE-400 (Uncontrolled Resource Consumption) characterizes the root cause: the write path did not validate whether a supplied buffer was within valid bounds before proceeding, meaning an oversized or malformed buffer could drive resource exhaustion or trigger undefined behavior leading to a process crash. The fix by RafaelGSS (commit af0bf96877 series, nodejs-private/node-private) introduces an explicit bounds check that throws a catchable JavaScript error, converting an unhandled fault into a recoverable exception. No explicit CPE string was provided in the input, but the affected artifact is the node binary for the Current release line (v26.x) prior to v26.5.1.