Cloudanix VulnDB

CVE-2026-106071

Low · 3.6

CVSS

3.6

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Node.js security settings can let programs reach files they were supposed to be blocked from accessing.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
High
Impact
Data Exposure
Component
Application
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The permission model's radix tree for wildcard --allow-fs-read and --allow-fs-write grants stops comparison early when the requested path is shorter than the grant prefix, causing the shorter path to be treated as a match and bypassing the intended restriction.

Why it matters to the business

Local processes can read or write files that should remain inaccessible under the configured permissions, increasing risk of unauthorized data exposure or tampering in Node.js 26.x deployments.

How an attack unfolds

An attacker with local execution rights starts a Node.js 26.x process using a root-level wildcard permission grant, then requests a shorter path that the flawed lookup accepts as allowed.

How to fix it

Upgrade to the next available Node.js 26.x release that corrects the radix tree comparison logic; avoid root-level wildcard grants until the fix is applied and review all existing permission configurations.

How to confirm the fix worked

After upgrade, confirm that paths shorter than a wildcard prefix are correctly denied by exercising the permission model with test grants and access attempts.

Typical attack path

  1. Locate or start a Node.js 26.x process that uses the permission model with a root-level wildcard grant
  2. Request a file system path shorter than the wildcard prefix
  3. Obtain read or write access that the grant was intended to deny

How to detect it

Search process command lines and startup logs for wildcard permission flags placed directly under the root; monitor file access logs for unexpected reads or writes to paths that match the premature-match pattern.

  • --allow-fs-read=/etc/passwd.*
  • --allow-fs-write=/etc/passwd.*
  • access to /etc/passwd via permission model

What your security team should do

  • Prioritize patching Node.js 26.x instances as soon as a fixed release is published
  • Audit current --allow-fs-* flags for root-level wildcards and replace them with more specific grants
  • Add command-line logging of permission flags to detect risky configurations

The record

A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, `--allow-fs-read=/etc/passwd.*` also allows reading `/etc/passwd`. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043. This vulnerability affects Node.js **26.x**.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities