< Back

CVE-2026-106073

Updated on 23 Oct 2026

Severity

3.3 Low severity

Details

CVSS score
3.3
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync() without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered fs.realpathSync.native().

As a result, code running under --permission with restricted --allow-fs-read can still use fs.realpathSync() to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.

This vulnerability affects Node.js 26.x, 24.x, and 22.x.

Details

Affected product:
AlmaLinux 9.2 ESU , Alpine Linux 3.23 , Alpine Linux 3.24 , Debian 10 , Debian 11 , Debian 12 , Debian 13 , EL 10 , EL 6 , EL 7 , EL 8 , EL 9 , TuxCare 9.6 ESU , TuxCare 9.8 ESU , Ubuntu 18.04 , Ubuntu 20.04 , Ubuntu 22.04 , Ubuntu 24.04 , Ubuntu 26.04
Affected packages:
nodejs @ 16.20.2 (+115 more)

Fixes