CVE-2026-58043

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-58043
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58043.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-58043
Aliases
Downstream
Related
Published
2026-07-30T06:02:50.095Z
Modified
2026-08-27T11:47:47.845915072Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N CVSS Calculator
Summary
[none]
Details

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.

Under --permission, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist.

This vulnerability affects Node.js main, 22.x, 24.x, and 26.x.

Database specific 
{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "22.23.1"
                },
                {
                    "last_affected": "22.23.1"
                },
                {
                    "introduced": "24.18.0"
                },
                {
                    "last_affected": "24.18.0"
                },
                {
                    "introduced": "26.5.0"
                },
                {
                    "last_affected": "26.5.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "hackerone",
    "cwe_ids": [
        "CWE-284"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58043.json"
}
References

Affected packages

Git / github.com/nodejs/node

Affected ranges

Type
GIT
Repo
https://github.com/nodejs/node
Events
Introduced
12fb157f79da8c094a54bc99370994941c28c235
Last affected
bd96dfbf0361576724b65322046e2ca9f9609cb9
Introduced
c5349f43cd66d2aa02d86414c9ed426f71d3ae48
Last affected
20da4aeadabc5b0a01e3fcf520f91df8285c68a2
Introduced
1eaf8a9bd9b665c104bc49f1890e962dddc87d8c
Last affected
bebd1b8d92bf4cc917844d6335ed1ecf9c2a75fb
Database specific
Show details 
{
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "22.0"
        },
        {
            "last_affected": "22.23.1"
        },
        {
            "introduced": "24.0.0"
        },
        {
            "last_affected": "24.18.0"
        },
        {
            "introduced": "26.0.0"
        },
        {
            "last_affected": "26.5.0"
        }
    ],
    "cpe": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*"
}

Affected versions

v22.*
v22.0.0
v22.1.0
v22.10.0
v22.11.0
v22.12.0
v22.13.0
v22.13.1
v22.14.0
v22.15.0
v22.15.1
v22.16.0
v22.17.0
v22.17.1
v22.18.0
v22.19.0
v22.2.0
v22.20.0
v22.21.0
v22.21.1
v22.22.0
v22.22.1
v22.22.2
v22.22.3
v22.23.0
v22.23.1
v22.3.0
v22.4.0
v22.4.1
v22.5.0
v22.5.1
v22.6.0
v22.7.0
v22.8.0
v22.9.0
v24.*
v24.0.0
v24.0.1
v24.0.2
v24.1.0
v24.10.0
v24.11.0
v24.11.1
v24.12.0
v24.13.0
v24.13.1
v24.14.0
v24.14.1
v24.15.0
v24.16.0
v24.17.0
v24.18.0
v24.2.0
v24.3.0
v24.4.0
v24.4.1
v24.5.0
v24.6.0
v24.7.0
v24.8.0
v24.9.0
v26.*
v26.0.0
v26.1.0
v26.2.0
v26.3.0
v26.3.1
v26.4.0
v26.5.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58043.json"