BIT-node-min-2026-106071

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/node-min/BIT-node-min-2026-106071.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-node-min-2026-106071
Aliases
Published
2026-10-29T08:56:12Z
Modified
2026-10-29T10:56:09Z
Summary
[none]
Details

A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard --allow-fs-read or --allow-fs-write rule.

When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, --allow-fs-read=/etc/passwd.* also allows reading /etc/passwd. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043.

This vulnerability affects Node.js 26.x.

Database specific 
{
    "cpes":  [
        "cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*"
    ],
    "severity":  "Low"
}
References

Affected packages

Bitnami / node-min

Package

Name
node-min
Purl
pkg:bitnami/node-min

Severity

  • 3.6 (Low) CVSS_V3 - CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
25.0.0
Fixed
26.12.1

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/node-min/BIT-node-min-2026-106071.json"