Live › vulnerability › CVE-2026-106071
Go to dashboardNode.js's Permission Model can let a process read or write a path that does not match a wildcard --allow-fs-read or --allow-fs-write rule. For example, the rule /etc/passwd.* also allows reading /etc/passwd, which bypasses the intended file restriction.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only teams running Node.js 26.x with the Permission Model enabled and a wildcard --allow-fs-read or --allow-fs-write grant. The sources say the wildcard must sit directly under the root of the permission tree, for example when it is the only grant for that scope. Teams on other Node.js lines, or without the Permission Model, can skip it.
No product ranges from the sources yet.
node --version and confirm whether it reports a 26.x release.--permission, --allow-fs-read or --allow-fs-write with a * wildcard.unknown.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard --allow-fs-read or --allow-fs-write rule.
When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, --allow-fs-read=/etc/passwd.* also allows reading /etc/passwd. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043.
This vulnerability affects Node.js 26.x.
This page as .md · .json · in your agent: get_signal("CVE-2026-106071")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.