CVE-2026-106073: Node.js Permission Model bypass with fs.realpathSync
With the Node.js Permission Model enabled, fs.realpathSync() did not check filesystem read permission, so code could resolve paths it was denied, while the equivalent entry points (fs.realpathSync.native(), fs.promises.realpath(), fs.lstatSync(), fs.existsSync()) already denied access for the same paths. The fix adds the permission check to realpathSync.
Published Oct 21, 2026
Advisory details
From the National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
With the Node.js Permission Model enabled, fs.realpathSync() did not check filesystem read permission, so code could resolve paths it was denied, while the equivalent entry points (fs.realpathSync.native(), fs.promises.realpath(), fs.lstatSync(), fs.existsSync()) already denied access for the same paths. The fix adds the permission check to realpathSync. Affected: Node.js 22.x before 22.23.4, 24.x before 24.22.1 and 26.x before 26.12.1. Fixed in Node.js 22.23.4, 24.22.1 and 26.12.1, released October 21, 2026.
Credited to 0xoroot.
References
- https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
- https://nodejs.org/en/blog/release/v22.23.4
- https://nodejs.org/en/blog/release/v24.22.1
- https://nodejs.org/en/blog/release/v26.12.1
- https://github.com/nodejs/node/commit/50ab804edc
- https://github.com/nodejs/node/commit/cc244131aa
- https://hackerone.com/reports/3838675
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
Coverage on the Beam blog
More Node.js vulnerabilities
All Node.js entriesCVE-2026-105481
Node.js keep-alive socket processes a response that was written before the request was sent
mediumOct 21, 2026CVE-2026-105482
Node.js dns.resolve truncates names containing NUL char
highOct 21, 2026CVE-2026-105483
Node.js TLS certificate hostname bypass when the IP is written fullwidth digits
highOct 21, 2026CVE-2026-106069
Node.js TLS certificate hostname bypass when the host loosely resolves to an IP address
highOct 21, 2026CVE-2026-106070
Node.js ZipFile returns attacker-controlled prefix bytes after failed ZIP header validation
lowOct 21, 2026CVE-2026-106071
Node.js Permission Model filesystem over-grant via wildcard radix lookup
lowOct 21, 2026