CVE-2026-58043CWE-284broken-access-control

CVE-2026-58043

High · published July 30, 2026

CVSS v3.1
8.4
EPSS
0%
Percentile
4.0
In the wild
Unconfirmed
What it is

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.

Under `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist.

This vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**.

The record
Technical detail
CVSS v3.1
8.4 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00152 · 4.0th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-07-30T10:25Z
Affected products (3)
ProductVersionsFixed in
nodejs/node.js≥ 22.0, ≤ 22.23.1—
nodejs/node.js≥ 24.0.0, ≤ 24.18.0—
nodejs/node.js≥ 26.0.0, ≤ 26.5.0—
References (1)
https://nodejs.org/en/blog/vulnerability/july-2026-security-releases · [email protected]
EPSS history
Timeline
  • 30 JUL 06:02Z
    A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries
    cvelistv5