Node.js Permission Model Over-Granting File System Access
CVE-2026-58043 Published on July 30, 2026
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**.
Weakness Type
What is an Authorization Vulnerability?
The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVE-2026-58043 has been classified to as an Authorization vulnerability or weakness.
Affected Versions
nodejs node:- Version 22.23.1, <= 22.23.1 is affected.
- Version 24.18.0, <= 24.18.0 is affected.
- Version 26.5.0, <= 26.5.0 is affected.