AZL-111032: CVE-2026-106073 affecting package nodejs for versions less than 24.22.1-0

Q: Who is exposed to this issue?

Applications running affected Node.js 22.x, 24.x, or 26.x releases with the Permission Model enabled are exposed when they restrict filesystem reads using --allow-fs-read. Code not running under --permission is not described as affected by this permission-enforcement bypass.

Q: What does an attacker need to exploit it?

An attacker needs the ability to cause code to execute within the affected Node.js process. The vulnerable code can call fs.realpathSync() despite restrictions intended to limit filesystem reads.

Q: What information can be exposed through the bypass?

The bypass can be used to test whether files exist, resolve symlink targets, and enumerate filesystem paths outside directories permitted by --allow-fs-read. The provided information describes filesystem-path disclosure rather than arbitrary file-content reading.

Q: How can I tell whether a deployment is affected?

Check whether the application uses Node.js 22.x, 24.x, or 26.x, starts with --permission, and relies on --allow-fs-read to constrain untrusted or less-trusted code. In affected environments, calls to fs.realpathSync() may access path information outside the configured allowed directories.

Q: What should be done if patching is not immediately possible?

Avoid running untrusted code in the affected Node.js process where possible, because that code may invoke fs.realpathSync() to bypass intended filesystem path restrictions. Do not rely on --allow-fs-read alone to prevent filesystem-path discovery until the affected package is updated.

Published Oct 23, 2026

Updated

A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync() without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered fs.realpathSync.native().

As a result, code running under --permission with restricted --allow-fs-read can still use fs.realpathSync() to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.

This vulnerability affects Node.js 26.x, 24.x, and 22.x.

Affected Software

1 affected componentFixes available

azure-linux/nodejs<24.22.1-0

24.22.1-0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade azure-linux/nodejs to a version that resolves this vulnerability.
Fixed in 24.22.1-0
Upgrade
Upgrade nodejs to a version that resolves this vulnerability.
Fixed in 24.22.1-0

Event History

Oct 23, 2026

Advisory Published

via OSV·05:17 PM

Data Sourced

via OSV·05:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-106073

Frequently Asked Questions

Who is exposed to this issue?

Applications running affected Node.js 22.x, 24.x, or 26.x releases with the Permission Model enabled are exposed when they restrict filesystem reads using --allow-fs-read. Code not running under --permission is not described as affected by this permission-enforcement bypass.

What does an attacker need to exploit it?

An attacker needs the ability to cause code to execute within the affected Node.js process. The vulnerable code can call fs.realpathSync() despite restrictions intended to limit filesystem reads.

What information can be exposed through the bypass?

The bypass can be used to test whether files exist, resolve symlink targets, and enumerate filesystem paths outside directories permitted by --allow-fs-read. The provided information describes filesystem-path disclosure rather than arbitrary file-content reading.

How can I tell whether a deployment is affected?

Check whether the application uses Node.js 22.x, 24.x, or 26.x, starts with --permission, and relies on --allow-fs-read to constrain untrusted or less-trusted code. In affected environments, calls to fs.realpathSync() may access path information outside the configured allowed directories.

What should be done if patching is not immediately possible?

Avoid running untrusted code in the affected Node.js process where possible, because that code may invoke fs.realpathSync() to bypass intended filesystem path restrictions. Do not rely on --allow-fs-read alone to prevent filesystem-path discovery until the affected package is updated.

AZL-111032: CVE-2026-106073 affecting package nodejs for versions less than 24.22.1-0

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What information can be exposed through the bypass?

How can I tell whether a deployment is affected?

What should be done if patching is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What information can be exposed through the bypass?

How can I tell whether a deployment is affected?

What should be done if patching is not immediately possible?