CVE-2026-58043: High severity OpenJS Node.js vulnerability
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under --permission, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This vulnerability affects Node.js main, 22.x, 24.x, and 26.x.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.18.1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58043?
The severity of CVE-2026-58043 is rated as high with a score of 7.5.
How do I fix CVE-2026-58043?
To fix CVE-2026-58043, you should update to the latest version of OpenJS Node.js where the vulnerability has been patched.
What are the potential impacts of CVE-2026-58043?
CVE-2026-58043 can allow an attacker to over-grant filesystem access, potentially leading to unauthorized read and write operations.
Who is affected by CVE-2026-58043?
CVE-2026-58043 affects users of OpenJS Node.js who utilize the permission model for filesystem access.
What does AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N mean in CVE-2026-58043?
The metrics indicate that the attack vector is local, with high complexity, low privileges required, and potentially causing complete compromise of confidentiality and integrity without affecting availability.