CVE-2026-58043: Permission Model: --allow-fs-read/--allow-fs-write radix-tree prefix-boundary over-grant
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.
Under --permission, an attacker who is granted access to one path can abuse radix-tree prefix boundary handling to read from or write to paths outside the intended filesystem allowlist.
Other sources
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.
Under --permission, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist.
This vulnerability affects Node.js main, 22.x, 24.x, and 26.x.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.18.1-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.23.2Fixed in 24.18.1Fixed in 26.5.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.23.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.18.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26.5.1 - Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 22.23.2-r0 - Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 24.18.1-r0 - Upgrade
Upgrade
alpine/nodejs-currentto a version that resolves this vulnerability.Fixed in 26.5.1-r0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2026-58043?
The severity of CVE-2026-58043 is rated as high with a score of 7.5.
How do I fix CVE-2026-58043?
To fix CVE-2026-58043, you should update to the latest version of OpenJS Node.js where the vulnerability has been patched.
What are the potential impacts of CVE-2026-58043?
CVE-2026-58043 can allow an attacker to over-grant filesystem access, potentially leading to unauthorized read and write operations.
Who is affected by CVE-2026-58043?
CVE-2026-58043 affects users of OpenJS Node.js who utilize the permission model for filesystem access.
What does AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N mean in CVE-2026-58043?
The metrics indicate that the attack vector is local, with high complexity, low privileges required, and potentially causing complete compromise of confidentiality and integrity without affecting availability.