CVE-2026-106071

About vulnerability

A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard --allow-fs-read or --allow-fs-write rule.

When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, --allow-fs-read=/etc/passwd.* also allows reading /etc/passwd. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043.

This vulnerability affects Node.js 26.x.

Affected product:

AlmaLinux 9.2 ESU , Alpine Linux 3.23 , Alpine Linux 3.24 , Debian 10 , Debian 11 , Debian 12 , Debian 13 , EL 10 , EL 6 , EL 7 , EL 8 , EL 9 , TuxCare 9.6 ESU , TuxCare 9.8 ESU , Ubuntu 18.04 , Ubuntu 20.04 , Ubuntu 22.04 , Ubuntu 24.04 , Ubuntu 26.04

Affected packages:

nodejs @ 16.20.2 (+106 more)