High severity8.4NVD Advisory· Published Jul 30, 2026· Updated Aug 25, 2026
CVE-2026-58043
CVE-2026-58043
Description
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.
Under --permission, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist.
This vulnerability affects Node.js main, 22.x, 24.x, and 26.x.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
28- osv-coords26 versionspkg:apk/wolfi/nodejs-22pkg:apk/chainguard/nodejs-22pkg:rpm/opensuse/nodejs24&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/nodejs22&distro=openSUSE%20Leap%2016.0pkg:bitnami/node-minpkg:rpm/almalinux/nodejs24-full-i18npkg:rpm/almalinux/nodejs-packaging-bundlerpkg:bitnami/nodepkg:rpm/opensuse/nodejs26&distro=openSUSE%20Tumbleweedpkg:rpm/almalinux/nodejs24pkg:rpm/opensuse/nodejs24&distro=openSUSE%20Tumbleweedpkg:rpm/almalinux/nodejspkg:rpm/almalinux/nodejs-develpkg:rpm/almalinux/nodejs-docspkg:rpm/almalinux/nodejs-full-i18npkg:rpm/almalinux/nodejs-libspkg:rpm/almalinux/nodejs-npmpkg:rpm/almalinux/nodejs24-docspkg:rpm/almalinux/nodejs24-libspkg:rpm/almalinux/nodejs24-npmpkg:rpm/almalinux/nodejs-nodemonpkg:rpm/almalinux/nodejs-packagingpkg:rpm/almalinux/npmpkg:rpm/almalinux/v8-12.4-develpkg:rpm/almalinux/v8-13.6-develpkg:rpm/almalinux/nodejs24-devel
< 22.23.2-r0+ 25 more
- (no CPE)range: < 22.23.2-r0
- (no CPE)range: < 22.23.2-r0
- (no CPE)range: < 24.18.1-160000.1.1
- (no CPE)range: < 22.23.2-160000.1.1
- (no CPE)range: < 22.23.2
- (no CPE)range: < 1:24.19.0-1.el10_2
- (no CPE)range: < 2021.06-6.module_el9.7.0+227+12323393
- (no CPE)range: < 22.23.2
- (no CPE)range: < 26.5.1-1.1
- (no CPE)range: < 1:24.19.0-1.el10_2
- (no CPE)range: < 24.18.1-1.1
- (no CPE)range: < 1:22.23.2-1.el10_2
- (no CPE)range: < 1:22.23.2-1.el10_2
- (no CPE)range: < 1:22.23.2-1.el10_2
- (no CPE)range: < 1:22.23.2-1.el10_2
- (no CPE)range: < 1:22.23.2-1.el10_2
- (no CPE)range: < 1:10.9.8-1.22.23.2.1.el10_2
- (no CPE)range: < 1:24.19.0-1.el10_2
- (no CPE)range: < 1:24.19.0-1.el10_2
- (no CPE)range: < 1:11.17.0-1.24.19.0.1.el10_2
- (no CPE)range: < 3.1.14-2.module_el9.8.0+291+0bb98cce
- (no CPE)range: < 2021.06-6.module_el9.7.0+227+12323393
- (no CPE)range: < 1:10.9.8-1.22.23.2.1.module_el9.8.0+302+959ebcd4
- (no CPE)range: < 3:12.4.254.21-1.22.23.2.1.module_el9.8.0+302+959ebcd4
- (no CPE)range: < 3:13.6.233.17-1.24.19.0.1.module_el9.8.0+301+084fac05
- (no CPE)range: < 1:24.19.0-1.el10_2
Patches
Vulnerability mechanics
References
1- nodejs.org/en/blog/vulnerability/july-2026-security-releasesnvdVendor Advisory
News mentions
1- Node.js Fixes 11 Security Flaws That Can Crash Servers and Break Filesystem RestrictionsCyber Security News · Jul 30, 2026