IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key
7.5High

CVE-2026-58043

nodejs node Published: (3 months ago)

Description

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**.

Weakness (CWE): CWE-284

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

VendorProductVersions
nodejs node 22.23.1 – ≤ 22.23.1, 24.18.0 – ≤ 24.18.0, 26.5.0 – ≤ 26.5.0
nodejs node.js 22.0 – ≤ 22.23.1

References and patches

CPE matches (NVD) (3)
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* ≥ 22.0 ≤ 22.23.1
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* ≥ 24.0.0 ≤ 24.18.0
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* ≥ 26.0.0 ≤ 26.5.0

Recent CVEs in the same product — Node.js

6.5Medium
CVE-2026-105481
nodejs node

A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that destroys idle keep-alive sockets when unexpected …

7.4High
CVE-2026-105482
nodejs node

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options. B…

7.4High
CVE-2026-105483
nodejs node

A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (`１２７.0.0.1`). `tls.checkServerIde…

7.4High
CVE-2026-106069
nodejs node

A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as `0127.0.0.1`. `tls.chec…

3.6Low
CVE-2026-106071
nodejs node

A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops…

3.3Low
CVE-2026-106073
nodejs node

A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`. As a result, code running under `--p…