The flaw allows a stale StatementSyncIterator to continue executing a cached prepared SQL statement even after the statement has been reset and rebound with different parameters. This bypasses the iterator invalidation mechanism introduced for StatementSync. As a result, a query can run with unintended parameters, potentially exposing sensitive data or modifying data in ways not intended by the application. The weakness is a form of iterator misuse (CWE‑367) that can undermine database integrity and confidentiality.

Node.js running versions 22.x, 24.x, and 26.x are affected. The vulnerability is present in the node:sqlite component of the Node.js runtime.

The assigned CVSS score of 5.3 indicates a medium impact. No EPSS score is available, and the issue is not listed in the CISA KEV catalog, suggesting that known exploitation is not documented. The likely attack vector is local or within an application that runs with sufficient privileges to execute code that resets sqlite statements, such as a web application server. An attacker with code execution authority could trigger the stale iterator to run queries with injected parameters, leading to unauthorized data access or modification.