Filesystem Enforcement Flaw in Node.js 26.x

CVE-2026-106071

What is CVE-2026-106071?

A vulnerability in the Node.js permission model allows unauthorized access to filesystem paths when wildcard rules are incorrectly matched. Specifically, when paths granted by rules such as '--allow-fs-read=/etc/passwd.*' are shorter than expected, the enforcement mechanism fails to properly validate the path. This flaw enables potential unauthorized access to sensitive files, compromising security measures intended to restrict filesystem read and write operations.

References