Node.js SQLite EUVD-2026-52561

The vulnerability resides in Node.js's built-in sqlite module, which was introduced in Node.js v22.5.0 as a first-class JavaScript binding to SQLite. The root cause is CWE-367 (Time-Of-Check Time-Of-Use Race Condition): when a prepared statement is reset - a common operation to re-execute a statement with new parameters - the internal tag store iterators that hold references to that statement's state are not invalidated. Code that subsequently iterates over those stale handles operates on inconsistent internal state, creating the TOCTOU window between the point the reset is observed and the point the iterator is consumed. The fix, attributed to Matteo Collina in nodejs-private/node-private, explicitly invalidates these iterators upon statement reset, closing the race window. No CPE string has been published to NVD at the time of this analysis as the disclosure is pre-NVD.