CVE-2026-106071: Permission Model filesystem over-grant via wildcard radix lookup
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard --allow-fs-read or --allow-fs-write rule. When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, --allow-fs-read=/etc/passwd. also allows reading /etc/passwd. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043. This vulnerability affects Node.js 26.x.
Other sources
A Node.js Permission Model filesystem over-grant lets a wildcard --allow-fs-read or --allow-fs-write rule match paths it should not. When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match, so for example --allow-fs-read=/etc/passwd. also allows reading /etc/passwd. It requires the wildcard grant to sit directly under the root of the permission tree, such as when it is the only grant for that scope.
— Node.Js
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26.12.1 - Upgrade
Upgrade
azurelinux/nodejsto a version that resolves this vulnerability.Fixed in 24.22.1-0 - Upgrade
Upgrade
bitnami/nodeto a version that resolves this vulnerability.Fixed in 26.12.1 - Upgrade
Upgrade
bitnami/node-minto a version that resolves this vulnerability.Fixed in 26.12.1 - Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 24.22.1-r0 - Upgrade
Upgrade
alpine/nodejs-currentto a version that resolves this vulnerability.Fixed in 26.12.1-r0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.23.5Fixed in 24.22.3Fixed in 26.13.1
Event History
Parent advisories
This vulnerability appears in the following advisories.