CVE-2026-106071: Node.js Permission Model filesystem over-grant via wildcard radix lookup
The Node.js Permission Model stores allowed filesystem paths in a radix tree. Its handling of wildcard nodes could grant access to paths outside the ones the --allow-fs-read or --allow-fs-write flags intended. The fix corrects the fs permission tree node handling for wildcard nodes. Affected: Node.js 26.x before 26.12.1. Fixed in Node.js 26.12.1, released October 21, 2026.
Published Oct 21, 2026
Advisory details
From the National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
The Node.js Permission Model stores allowed filesystem paths in a radix tree. Its handling of wildcard nodes could grant access to paths outside the ones the --allow-fs-read or --allow-fs-write flags intended. The fix corrects the fs permission tree node handling for wildcard nodes. Affected: Node.js 26.x before 26.12.1. Fixed in Node.js 26.12.1, released October 21, 2026.
Credited to malikhamzaiqbal.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
Coverage on the Beam blog
More Node.js vulnerabilities
All Node.js entriesCVE-2026-105481
Node.js keep-alive socket processes a response that was written before the request was sent
mediumOct 21, 2026CVE-2026-105482
Node.js dns.resolve truncates names containing NUL char
highOct 21, 2026CVE-2026-105483
Node.js TLS certificate hostname bypass when the IP is written fullwidth digits
highOct 21, 2026CVE-2026-106069
Node.js TLS certificate hostname bypass when the host loosely resolves to an IP address
highOct 21, 2026CVE-2026-106070
Node.js ZipFile returns attacker-controlled prefix bytes after failed ZIP header validation
lowOct 21, 2026CVE-2026-106072
Node.js improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints
mediumOct 21, 2026