CVE-2026-58039: Low severity OpenJS Node.js vulnerability
A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths.
This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.
This vulnerability affects Node.js 22.x, 24.x, and 26.x.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.18.1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58039?
The severity of CVE-2026-58039 is rated as low with a score of 3.3.
How do I fix CVE-2026-58039?
To mitigate CVE-2026-58039, ensure that your Node.js application enforces correct permissions and limit the use of process.report.
Which versions of Node.js are affected by CVE-2026-58039?
CVE-2026-58039 affects Node.js versions 22.x and 24.x.
What kind of impact does CVE-2026-58039 have?
CVE-2026-58039 can lead to confidentiality impacts and the potential to bypass intended security boundaries.
What is the main cause of CVE-2026-58039?
CVE-2026-58039 is caused by a flaw in the Node.js Permission Model enforcement that allows inappropriate file writes.