Back to Vulnerability Directory
HIGHFixed upstream
CVE-2026-58043
Node.js: permission model path matching over-grants file system access
Technology
Node.js
CVSS Score
8.4 / 10.0
Affected Versions
22.0 to 22.23.1; 24.0.0 to 24.18.0; 26.0.0 to 26.5.0
Upstream Fix
22.23.2; 24.18.1; 26.5.1
Published
July 30, 2026
OSSeva Coverage
Fixed upstream
Description
Under --permission, prefix boundary handling in the permission model's radix tree let code granted access to one path read from or write to paths outside the intended allowlist. Rated High by Node.js. Fixed in the July 2026 security releases: 22.23.2, 24.18.1 and 26.5.1.
Is your Node.js deployment affected?
If you're running 22.0 to 22.23.1; 24.0.0 to 24.18.0; 26.0.0 to 26.5.0, you need this patch. Book a discovery call to get covered.