AZL-111023: CVE-2026-106071 affecting package nodejs for versions less than 24.22.1-0

Q: Are default Node.js deployments affected?

The issue requires use of the Node.js Permission Model with a wildcard --allow-fs-read or --allow-fs-write grant. It also requires that wildcard grant to be directly under the root of the permission tree, such as when it is the only grant for that scope.

Q: What configuration should be reviewed to identify exposure?

Review Node.js startup options for wildcard filesystem permission rules, especially rules like --allow-fs-read=/etc/passwd.* or equivalent write grants. A configuration is exposed when a request for a shorter path than the wildcard prefix can be treated as matching.

Q: What can be done if the package cannot be updated immediately?

Avoid wildcard filesystem grants that sit directly under the root of the permission tree. In particular, remove or revise rules where access to a shorter path would be more permissive than intended, such as a wildcard rule for /etc/passwd.* allowing /etc/passwd.

Q: Which Node.js releases are identified as affected?

The vulnerability description identifies Node.js 26.x as affected. The package record lists versions earlier than 24.22.1-0 as affected.

Published Oct 23, 2026

Updated

A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard --allow-fs-read or --allow-fs-write rule.

When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, --allow-fs-read=/etc/passwd. also allows reading /etc/passwd. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043.

This vulnerability affects Node.js 26.x.

Affected Software

1 affected componentFixes available

azure-linux/nodejs<24.22.1-0

24.22.1-0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade azure-linux/nodejs to a version that resolves this vulnerability.
Fixed in 24.22.1-0
Upgrade
Upgrade nodejs to a version that resolves this vulnerability.
Fixed in 24.22.1-0

Event History

Oct 23, 2026

Advisory Published

via OSV·05:17 PM

Data Sourced

via OSV·05:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-106071

Frequently Asked Questions

Are default Node.js deployments affected?

The issue requires use of the Node.js Permission Model with a wildcard --allow-fs-read or --allow-fs-write grant. It also requires that wildcard grant to be directly under the root of the permission tree, such as when it is the only grant for that scope.

What configuration should be reviewed to identify exposure?

Review Node.js startup options for wildcard filesystem permission rules, especially rules like --allow-fs-read=/etc/passwd.* or equivalent write grants. A configuration is exposed when a request for a shorter path than the wildcard prefix can be treated as matching.

What can be done if the package cannot be updated immediately?

Avoid wildcard filesystem grants that sit directly under the root of the permission tree. In particular, remove or revise rules where access to a shorter path would be more permissive than intended, such as a wildcard rule for /etc/passwd.* allowing /etc/passwd.

Which Node.js releases are identified as affected?

The vulnerability description identifies Node.js 26.x as affected. The package record lists versions earlier than 24.22.1-0 as affected.

AZL-111023: CVE-2026-106071 affecting package nodejs for versions less than 24.22.1-0

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Are default Node.js deployments affected?

What configuration should be reviewed to identify exposure?

What can be done if the package cannot be updated immediately?

Which Node.js releases are identified as affected?

Company

Resources

Contact

Frequently Asked Questions

Are default Node.js deployments affected?

What configuration should be reviewed to identify exposure?

What can be done if the package cannot be updated immediately?

Which Node.js releases are identified as affected?