CVE-2026-106073
published 2026-10-23CVE-2026-106073: A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of…
PriorityP413low3.3CVSS 3.0
AVLACLPRLUINSUCLINAN
EPSS
0.24%
15.6th percentile
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`.
As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.
This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| nodejs | node | 22.23.3 – 22.23.3 | — |
| nodejs | node | 24.22.0 – 24.22.0 | — |
| nodejs | node | 26.12.0 – 26.12.0 | — |
| nodejs_22 | nodejs | — | — |
| nodejs_24 | nodejs | — | — |
| nodejs_26 | nodejs | — | — |
CVSS provenance
nvdv3.03.3LOWCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
vendor_redhat3.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Node.js prior 22.23.3/24.22.0/26.12.0 Permission Model fs.realpathSync permission
vuldb·2026-10-23·CVSS 3.3
CVE-2026-106073 [LOW] Node.js prior 22.23.3/24.22.0/26.12.0 Permission Model fs.realpathSync permission
A vulnerability was found in Node.js and classified as problematic. Affected is the function fs.realpathSync of the component Permission Model. Such manipulation leads to permission issues.
This vulnerability is documented as CVE-2026-106073. The attack can be executed remotely. There is not any exploit available.
It is suggested to upgrade the affected component.
GHSA
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks.
ghsa_unreviewed·2026-10-23·CVSS 3.3
CVE-2026-106073 [LOW] CWE-284 A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks.
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`.
As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.
This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
Red Hat
nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()
vendor_redhat·2026-10-23·CVSS 3.3
CVE-2026-106073 [LOW] CWE-425 nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()
nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`.
As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.
This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
A flaw was found in the Node.js Permission Model. fs.realpathSync() does not perform the filesystem read permission checks required of comparable fs APIs. This is an incomplete fix of CVE-2026-21715, whic
Fortinet
Multiple Node.js CVEs
vendor_fortinet·CVSS 6.5
CVE-2026-105482 [MEDIUM] Multiple Node.js CVEs
FG-IR-26-187: Multiple Node.js CVEs
CVSSv3 Score:
9.8
CVE-2026-105482 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105483 - (high)This vulnerability affects Node.js 26.x and 24.x.CVE-2026-106069 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-111497 - (high)A flaw in Node.js can cause Node.js Brotli decoder out-of-bounds write permits remote code execution.This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105481 - (medium)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-106072 - (medium)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-106074 - (medium)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-106070 - (low)This vulnerability affects Node.js 26.x.CVE-2026-106071 -
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-106073 nodejs24: Node.js: Filesystem read permission bypass via fs.realpathSync() [fedora-rawhide]
bugzilla·2026-10-26·CVSS 3.3
CVE-2026-106073 [LOW] CVE-2026-106073 nodejs24: Node.js: Filesystem read permission bypass via fs.realpathSync() [fedora-rawhide]
CVE-2026-106073 nodejs24: Node.js: Filesystem read permission bypass via fs.realpathSync() [fedora-rawhide]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`.
As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.
This vulnera
Bugzilla
CVE-2026-106073 nodejs26: Node.js: Filesystem read permission bypass via fs.realpathSync() [fedora-rawhide]
bugzilla·2026-10-26·CVSS 3.3
CVE-2026-106073 [LOW] CVE-2026-106073 nodejs26: Node.js: Filesystem read permission bypass via fs.realpathSync() [fedora-rawhide]
CVE-2026-106073 nodejs26: Node.js: Filesystem read permission bypass via fs.realpathSync() [fedora-rawhide]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`.
As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.
This vulnera
Bugzilla
CVE-2026-106073 nodejs22: Node.js: Filesystem read permission bypass via fs.realpathSync() [fedora-44]
bugzilla·2026-10-26·CVSS 3.3
CVE-2026-106073 [LOW] CVE-2026-106073 nodejs22: Node.js: Filesystem read permission bypass via fs.realpathSync() [fedora-44]
CVE-2026-106073 nodejs22: Node.js: Filesystem read permission bypass via fs.realpathSync() [fedora-44]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`.
As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.
This vulnerabilit
Bugzilla
CVE-2026-106073 nodejs24: Node.js: Filesystem read permission bypass via fs.realpathSync() [fedora-44]
bugzilla·2026-10-26·CVSS 3.3
CVE-2026-106073 [LOW] CVE-2026-106073 nodejs24: Node.js: Filesystem read permission bypass via fs.realpathSync() [fedora-44]
CVE-2026-106073 nodejs24: Node.js: Filesystem read permission bypass via fs.realpathSync() [fedora-44]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`.
As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.
This vulnerabilit
Bugzilla
CVE-2026-106073 nodejs22: Node.js: Filesystem read permission bypass via fs.realpathSync() [fedora-43]
bugzilla·2026-10-26·CVSS 3.3
CVE-2026-106073 [LOW] CVE-2026-106073 nodejs22: Node.js: Filesystem read permission bypass via fs.realpathSync() [fedora-43]
CVE-2026-106073 nodejs22: Node.js: Filesystem read permission bypass via fs.realpathSync() [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`.
As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.
This vulnerabilit
Bugzilla
CVE-2026-106073 nodejs22: Node.js: Filesystem read permission bypass via fs.realpathSync() [fedora-rawhide]
bugzilla·2026-10-26·CVSS 3.3
CVE-2026-106073 [LOW] CVE-2026-106073 nodejs22: Node.js: Filesystem read permission bypass via fs.realpathSync() [fedora-rawhide]
CVE-2026-106073 nodejs22: Node.js: Filesystem read permission bypass via fs.realpathSync() [fedora-rawhide]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`.
As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.
This vulnera
Bugzilla
CVE-2026-106073 nodejs24: Node.js: Filesystem read permission bypass via fs.realpathSync() [fedora-43]
bugzilla·2026-10-26·CVSS 3.3
CVE-2026-106073 [LOW] CVE-2026-106073 nodejs24: Node.js: Filesystem read permission bypass via fs.realpathSync() [fedora-43]
CVE-2026-106073 nodejs24: Node.js: Filesystem read permission bypass via fs.realpathSync() [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`.
As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.
This vulnerabilit
Bugzilla
CVE-2026-106073 nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()
bugzilla·2026-10-23·CVSS 3.3
CVE-2026-106073 [LOW] CVE-2026-106073 nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()
CVE-2026-106073 nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`.
As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.
This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
2026-10-23
Published