Live › vulnerability › CVE-2026-106073
Go to dashboardNode.js's Permission Model does not apply read checks to fs.realpathSync(), so code run with --permission and a restricted --allow-fs-read can still check whether files exist, resolve symlink targets and list paths outside its allowed directories. This is an incomplete fix of CVE-2026-21715, which only covered fs.realpathSync.native().
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only applications that run Node.js with the Permission Model enabled (--permission) and a restricted --allow-fs-read list are exposed, since that is the only case where the missing check matters. Teams running Node.js without the permission flag, or relying on OS-level isolation, can skip it.
No product ranges from the sources yet.
node --version and compare against the fixed releases listed in the advisory; affected lines are 22.x, 24.x and 26.x.--permission or --experimental-permission together with --allow-fs-read in process start scripts, Dockerfiles or service units.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync() without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered fs.realpathSync.native().
As a result, code running under --permission with restricted --allow-fs-read can still use fs.realpathSync() to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.
This vulnerability affects Node.js 26.x, 24.x, and 22.x.
This page as .md · .json · in your agent: get_signal("CVE-2026-106073")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.