CVE-2026-106071
published 2026-10-23CVE-2026-106071: A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule…
PriorityP415low3.6CVSS 3.0
AVLACHPRLUINSUCLILAN
EPSS
0.19%
8.8th percentile
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule.
When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, `--allow-fs-read=/etc/passwd.*` also allows reading `/etc/passwd`. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043.
This vulnerability affects Node.js **26.x**.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| nodejs | node | 26.12.0 – 26.12.0 | — |
| nodejs_26 | nodejs | — | — |
CVSS provenance
nvdv3.03.6LOWCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
vendor_redhat3.6LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
nodejs: nodejs: Permission model bypass via wildcard path matching flaw
vendor_redhat·2026-10-23·CVSS 3.6
CVE-2026-106071 [LOW] CWE-284 nodejs: nodejs: Permission model bypass via wildcard path matching flaw
nodejs: nodejs: Permission model bypass via wildcard path matching flaw
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule.
When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, `--allow-fs-read=/etc/passwd.*` also allows reading `/etc/passwd`. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043.
This vulnerability affects Node.js **26.x**.
A flaw was found in the Node.js Permission Model. Wildcard --allow-fs-read or --allow-fs-write rules
Fortinet
Multiple Node.js CVEs
vendor_fortinet·CVSS 6.5
CVE-2026-105482 [MEDIUM] Multiple Node.js CVEs
FG-IR-26-187: Multiple Node.js CVEs
CVSSv3 Score:
9.8
CVE-2026-105482 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105483 - (high)This vulnerability affects Node.js 26.x and 24.x.CVE-2026-106069 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-111497 - (high)A flaw in Node.js can cause Node.js Brotli decoder out-of-bounds write permits remote code execution.This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105481 - (medium)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-106072 - (medium)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-106074 - (medium)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-106070 - (low)This vulnerability affects Node.js 26.x.CVE-2026-106071 -
GHSA
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule.
ghsa_unreviewed·2026-10-23·CVSS 8.4
CVE-2026-106071 [HIGH] CWE-284 A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule.
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule.
When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, `--allow-fs-read=/etc/passwd.*` also allows reading `/etc/passwd`. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043.
This vulnerability affects Node.js **26.x**.
VulDB
Node.js up to 26.12.0 Permission Model privileges management
vuldb·2026-10-23·CVSS 3.6
CVE-2026-106071 [LOW] Node.js up to 26.12.0 Permission Model privileges management
A vulnerability classified as problematic has been found in Node.js up to 26.12.0. Impacted is an unknown function of the component Permission Model. Performing a manipulation results in improper privilege management.
This vulnerability is identified as CVE-2026-106071. The attack is only possible with local access. There is not any exploit available.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-106071 nodejs26: nodejs: Permission model bypass via wildcard path matching flaw [fedora-rawhide]
bugzilla·2026-10-26·CVSS 3.6
CVE-2026-106071 [LOW] CVE-2026-106071 nodejs26: nodejs: Permission model bypass via wildcard path matching flaw [fedora-rawhide]
CVE-2026-106071 nodejs26: nodejs: Permission model bypass via wildcard path matching flaw [fedora-rawhide]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule.
When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, `--allow-fs-read=/etc/passwd.*` also allows reading `/etc/passwd`. This requires the wildcard grant to sit directly under the root of the permissi
Bugzilla
CVE-2026-106071 nodejs: nodejs: Permission model bypass via wildcard path matching flaw
bugzilla·2026-10-23·CVSS 3.6
CVE-2026-106071 [LOW] CVE-2026-106071 nodejs: nodejs: Permission model bypass via wildcard path matching flaw
CVE-2026-106071 nodejs: nodejs: Permission model bypass via wildcard path matching flaw
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule.
When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, `--allow-fs-read=/etc/passwd.*` also allows reading `/etc/passwd`. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043.
This vulnerability affects Node.js **26.x**.
2026-10-23
Published