CVE-2026-58043

HIGH7.5

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries

Published Jul 30, 2026

Modified 3 weeks ago

Details

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.

Under --permission, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist.

This vulnerability affects Node.js main, 22.x, 24.x, and 26.x.

Affected Packages

Node.js

Windows 10 (1507)Windows 10 (1607) / Server 2016Windows 10 (1703)Windows 10 (1709)Windows 10 (1803)

References

WEB

https://nodejs.org/en/blog/vulnerability/july-2026-security-releases

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-58043

CVSS Analysis

CVSS v3.0

7.5

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

HighAC:H

Privileges Required

LowPR:L

User Interaction

NoneUI:N

Scope

ChangedS:C

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

NoneA:N

7.5/CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Weakness Type (CWE)

Configuration

CWE-284

Improper Access Control

Ecosystems(22)

Windows 10 (1507)Windows 10 (1607) / Server 2016 Windows 10 (1703)Windows 10 (1709)Windows 10 (1803)

Timeline

PublishedJul 30, 2026

ModifiedJul 31, 2026

CVE-2026-58043 | Mondoo Vulnerability Intelligence