CVE-2026-106073: Permission Model bypass with fs.realpathSync
Published Oct 21, 2026
·Updated
Affected Software
4 affected componentsFixes available
Node.js Node.js>=22.0.0<22.23.4, >=24.0.0<24.22.1, >=26.0.0<26.12.1
22.23.424.22.126.12.1
Node.js Node.js>=22.0.0<22.23.4
22.23.4
Node.js Node.js>=24.0.0<24.22.1
24.22.1
Node.js Node.js>=26.0.0<26.12.1
26.12.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.23.4Fixed in 24.22.1Fixed in 26.12.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.23.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.22.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26.12.1
Event History
Oct 21, 2026
CVE Published
via Node.js·10:39 AM
Data Sourced
via Node.js·10:39 AM
SeverityAffected Software
Data Sourced
via Node.js·10:00 PM
Description
Parent advisories
This vulnerability appears in the following advisories.