Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Node.js may let programs read files they shouldn’t

published 12 days ago
Summary

Versions of Node.js before 24.22.1 can mistakenly treat a file‑path pattern as a match, allowing a program to read or write files it was not intended to access. This could let an application access sensitive files such as /etc/passwd. Upgrade Node.js to the latest version or later than 24.22.1 to close the gap.

What to do
  • Update nodejs to version 24.22.1-0.
Affected software
Ecosystem VendorProductAffected versions
Azure Linux:3 azure nodejs <= 24.21.0-1
Azure Linux:3 – nodejs < 24.22.1-0
Fix: upgrade to 24.22.1-0
Original advisory text
CVE-2026-106071 affecting package nodejs for versions less than 24.22.1-0
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule.

When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, `--allow-fs-read=/etc/passwd.*` also allows reading `/etc/passwd`. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043.

This vulnerability affects Node.js **26.x**.
References
Timeline
Published23 Oct 2026
Updated28 Oct 2026
First seen25 Oct 2026
Sources
AZL-111023 · OSV
Track software like this
Free during beta