Node.js Filesystem Vulnerability in Versions 22.x, 24.x, and 26.x

CVE-2026-106073

What is CVE-2026-106073?

A vulnerability in Node.js's permission model allows unauthorized access to the filesystem. The flaw affects the fs.realpathSync() method, which bypasses necessary read permission checks. This loophole enables code executing with restricted filesystem permissions to confirm file existence, resolve symlink targets, and explore directories outside the allowed paths. This issue represents an incomplete resolution of a previous vulnerability, indicating a need for enhanced security measures in future Node.js releases.

References