UBUNTU-CVE-2026-58043

HIGH7.5

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one path can abuse bound

Published Jul 30, 2026

Modified 1 weeks ago

Details

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under --permission, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This vulnerability affects Node.js main, 22.x, 24.x, and 26.x.

Affected Packages

nodejs

Ubuntu Pro 16.04 LTS

Affected versions:

0.10.25~dfsg2-2ubuntu14.2.2~dfsg-14.2.3~dfsg-14.2.4~dfsg-1ubuntu14.2.4~dfsg-24.2.6~dfsg-1ubuntu14.2.6~dfsg-1ubuntu44.2.6~dfsg-1ubuntu4.14.2.6~dfsg-1ubuntu4.24.2.6~dfsg-1ubuntu4.2+esm1+2 more

References

REPORT

https://nodejs.org/en/blog/vulnerability/july-2026-security-releases

REPORT

https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#permission-model-path-matching-can-over-grant-filesystem-access-cve-2026-58043---high

REPORT

https://ubuntu.com/security/CVE-2026-58043

REPORT

https://www.cve.org/CVERecord?id=CVE-2026-58043

CVSS Analysis

CVSS v3.0

Exploitability