{"id":"CVE-2026-106071","kind":"vulnerability","aliases":["CVE-2026-106071"],"related":[],"title":"Node.js: wildcard file permission grants also allow shorter paths","description":"A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule.\n\nWhen the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, `--allow-fs-read=/etc/passwd.*` also allows reading `/etc/passwd`. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043.\n\nThis vulnerability affects Node.js **26.x**.","summary":"Node.js's Permission Model can let a process read or write a path that does not match a wildcard --allow-fs-read or --allow-fs-write rule. For example, the rule /etc/passwd.* also allows reading /etc/passwd, which bypasses the intended file restriction.","severity":"low","cvss":3.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["node.js","permission-model","poc-public","runtime","self-hosted"],"not_affected_if":["default-config","no-wildcard-grants"],"how_to_check":"- Run `node --version` and confirm whether it reports a 26.x release.\n- Check whether startup scripts or deployment config use `--permission`, `--allow-fs-read` or `--allow-fs-write` with a `*` wildcard.\n- Confirm the wildcard grant is the only grant under the root of the permission tree, which the sources say is required.","fix":"- Upgrade Node.js 26.x to a patched release; the sources do not name the fixed version, so `unknown`.\n- Until patched, replace wildcard file grants with explicit, exact paths.","status":"open","published_at":"2026-10-23T17:17:20+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T04:45:23+00:00","updated_at":"2026-10-25T04:45:23+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-25T04:45:23Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Node.js 26.x to a patched release; the sources do not name the fixed version, so `unknown`.\n- Until patched, replace wildcard file grants with explicit, exact paths.","reach":"local","title":"Node.js: wildcard file permission grants also allow shorter paths","impact":"medium","summary":"Node.js's Permission Model can let a process read or write a path that does not match a wildcard --allow-fs-read or --allow-fs-write rule. For example, the rule /etc/passwd.* also allows reading /etc/passwd, which bypasses the intended file restriction.","category":"runtime","nicknames":[],"who_cares":["node.js","self-hosted","permission-model"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Process reads or writes files outside its intended wildcard-restricted paths.","analyst_note":"Confirm the patched Node.js 26.x version and whether the flaw reaches the process from outside it, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-106071.","how_to_check":"- Run `node --version` and confirm whether it reports a 26.x release.\n- Check whether startup scripts or deployment config use `--permission`, `--allow-fs-read` or `--allow-fs-write` with a `*` wildcard.\n- Confirm the wildcard grant is the only grant under the root of the permission tree, which the sources say is required.","needs_analyst":true,"not_affected_if":["default-config","no-wildcard-grants"],"who_is_affected":"Only teams running Node.js 26.x with the Permission Model enabled and a wildcard --allow-fs-read or --allow-fs-write grant. The sources say the wildcard must sit directly under the root of the permission tree, for example when it is the only grant for that scope. Teams on other Node.js lines, or without the Permission Model, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000695,"input_tokens":3505,"output_tokens":688,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-106071':12A,15A '-2026':11A,14A,172C '-58043':173C '/etc/passwd':60B,64B,133C,137C '26':178C 'access':81C 'affect':176C 'allow':7A,47B,52B,62B,91C,96C,130C,135C 'allow-fs-read':46B,90C,129C 'allow-fs-writ':51B,95C 'also':6A,61B,134C 'bypass':66B 'caus':169C 'compar':118C 'cve':10A,13A,171C 'differ':167C 'direct':145C 'earli':119C 'enforc':78C 'exampl':57B,128C,154C 'file':3A,69B 'filesystem':77C 'flaw':72C 'fs':48B,53B,92C,97C,131C 'grant':5A,80C,112C,142C,160C 'host':26B 'intend':68B 'let':32B 'lookup':116C 'match':43B,87C,126C 'model':19B,30B,76C 'node.js':1A,16B,27B,74C,177C 'path':9A,39B,83C,103C,123C 'permiss':4A,18B,29B,75C,151C 'permission-model':17B 'poc':21B 'poc-publ':20B 'prefix':108C 'process':34B 'public':22B 'radix':114C 'read':35B,49B,63B,93C,132C,136C 'request':102C 'requir':139C 'restrict':70B 'root':148C,168C 'rule':55B,59B,99C 'runtim':23B 'scope':163C 'self':25B 'self-host':24B 'shorter':8A,105C 'sit':144C 'stop':117C 'treat':121C 'tree':115C,152C 'vulner':175C 'wildcard':2A,45B,89C,111C,141C 'write':37B,54B,98C 'x':179C","nicknames":[],"mitigations":[],"who_affected":"Only teams running Node.js 26.x with the Permission Model enabled and a wildcard --allow-fs-read or --allow-fs-write grant. The sources say the wildcard must sit directly under the root of the permission tree, for example when it is the only grant for that scope. Teams on other Node.js lines, or without the Permission Model, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T17:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"support@hackerone.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-106071","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106071","severity":null,"published_at":"2026-10-23T17:17:20+00:00","modified_at":"2026-10-23T19:42:24+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"github-poc","external_id":"CompleteTech-LLC/node-cve-2026-106071-check","url":"https://github.com/CompleteTech-LLC/node-cve-2026-106071-check","severity":null,"published_at":"2026-10-23T23:48:35+00:00","modified_at":null,"first_seen_at":"2026-10-23T23:55:02+00:00","fetched_at":"2026-10-23T23:55:02+00:00","note":null}],"documents":[{"id":2240,"url":"https://github.com/CompleteTech-LLC/node-cve-2026-106071-check","title":"CompleteTech-LLC/node-cve-2026-106071-check","kind":"poc","source":"github","text":"Standalone defensive checker project for CVE-2026-106071: Node.js: Permission Model wildcard path over-grant. One exploit per repository; implementation pending.\n\nstars 0","published_at":"2026-10-23T23:48:35+00:00","relation":"poc","confidence":null,"note":"0 stars"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}