CVE-2026-58045 is a denial-of-service vulnerability in Node.js's synchronous zlib bindings. The trigger is deceptively simple: pass a TypedArray with a spoofed or inconsistent byteLength to any of the synchronous zlib functions. The native binding doesn't validate the byteLength against the actual buffer geometry—it hits an assertion instead, crashing the entire Node.js process.
This isn't a complex exploitation scenario. Unlike vulnerabilities requiring race conditions or specific timing, triggering this crash is deterministic: malformed input in, process abort out. Each HTTP request to a server using synchronous zlib is a fresh exploitation opportunity. The 'repeated exploitation' language in the CVE is misleading—there are no barriers to repetition in a request-response context.
The blast radius matters more than the CVSS 6.2 suggests. When the synchronous API crashes, it terminates the worker handling that request—but also any other in-flight requests on that worker, potentially mid-write to databases or clients. If you're running Node.js 22.x, 24.x, or 26.x with synchronous zlib operations exposed to untrusted input, a single malformed request can take down your entire request handling for that process.
The async zlib API reportedly handles the same inputs gracefully. This suggests the vulnerability is specific to the synchronous binding's design choice to rely on assertions as a validation shortcut rather than proper error handling. Audit your codebase for synchronous zlib calls (sync compress, decompress, gzip, gunzip variants) that accept user-controlled TypedArray input. If you can't patch immediately, implement process-level crash recovery (clustering, process managers) to limit blast radius. The fix requires replacing assertion-based validation with proper input checks in the affected synchronous functions—verify byteLength matches actual buffer dimensions before calling native code.