Filesystem Access Vulnerability in Node.js

CVE-2026-58043

What is CVE-2026-58043?

A vulnerability exists in the permission model of Node.js that can allow an attacker to gain unauthorized filesystem access. Under specific configurations, such as the --permission flag, this flaw can lead to over-granted access across radix-tree prefix boundaries. Exploiting this flaw enables an attacker who has been granted access to a certain path to manipulate boundary handling, gaining the ability to read from or write to paths that fall outside the designated filesystem allowlist. This could lead to significant security breaches and misuse of data.

References