Vulnpedia
← Search CVEs

CVE-2026-106071

LOW 3.6

Published 2026-10-23 · Last modified 2026-10-23

A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, `--allow-fs-read=/etc/passwd.*` also allows reading `/etc/passwd`. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043. This vulnerability affects Node.js **26.x**.

NO EXPLOITATION SIGNALS

No known exploitation, public exploit, or elevated probability at this time. Track for changes.

Exploitation likelihood

0.2%chance of exploitation in 30 days · 9th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

3.6CVSS 3.0 · LOW

  • ConfidentialityLow
  • IntegrityLow
  • AvailabilityNone

What an attacker needs

  • ⚠Access: Requires local access to the host
  • ⚠Privileges: Requires a low-privilege account
  • ✓User interaction: No user interaction needed
  • ⚠Complexity: Needs a race window or specific setup

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Nodejs

Products Node

Weakness (CWE)

  • CWE-284: Improper Access Control - Generic

CVSS vector

CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N/CR:M/IR:M/AR:M

References and research data (JSON)

Vendor product assessments

Showing 32 of 67 vendor product statements; 35 omitted. Read the full vendor advisory.

  • nodejs26.src as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs26?arch=src

    • workaround: If the Permission Model is unused, do not enable --permission. When using --allow-fs-read/--allow-fs-write, avoid wildcard grants placed as the sole root-level rule; prefer explicit directory prefixes without ambiguous wildcards (CME-1303 Application-Level Filesystem Access Confinement: https://cmetaxonomy.org/entries/CME-1303.html). Combine application allowlists with OS confinement such as SELinux or container filesystem restrictions (CME-301: https://cmetaxonomy.org/entries/CME-301.html; CME-702: https://cmetaxonomy.org/entries/CME-702.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106071 · Updated 2026-10-26T11:05:39+00:00
  • nodejs-docs (nodejs:26) as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs-docs?rpmmod=nodejs:26

    • workaround: If the Permission Model is unused, do not enable --permission. When using --allow-fs-read/--allow-fs-write, avoid wildcard grants placed as the sole root-level rule; prefer explicit directory prefixes without ambiguous wildcards (CME-1303 Application-Level Filesystem Access Confinement: https://cmetaxonomy.org/entries/CME-1303.html). Combine application allowlists with OS confinement such as SELinux or container filesystem restrictions (CME-301: https://cmetaxonomy.org/entries/CME-301.html; CME-702: https://cmetaxonomy.org/entries/CME-702.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106071 · Updated 2026-10-26T11:05:39+00:00
  • nodejs-full-i18n (nodejs:26) as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs-full-i18n?rpmmod=nodejs:26

    • workaround: If the Permission Model is unused, do not enable --permission. When using --allow-fs-read/--allow-fs-write, avoid wildcard grants placed as the sole root-level rule; prefer explicit directory prefixes without ambiguous wildcards (CME-1303 Application-Level Filesystem Access Confinement: https://cmetaxonomy.org/entries/CME-1303.html). Combine application allowlists with OS confinement such as SELinux or container filesystem restrictions (CME-301: https://cmetaxonomy.org/entries/CME-301.html; CME-702: https://cmetaxonomy.org/entries/CME-702.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106071 · Updated 2026-10-26T11:05:39+00:00
  • nodejs-libs (nodejs:26) as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs-libs?rpmmod=nodejs:26

    • workaround: If the Permission Model is unused, do not enable --permission. When using --allow-fs-read/--allow-fs-write, avoid wildcard grants placed as the sole root-level rule; prefer explicit directory prefixes without ambiguous wildcards (CME-1303 Application-Level Filesystem Access Confinement: https://cmetaxonomy.org/entries/CME-1303.html). Combine application allowlists with OS confinement such as SELinux or container filesystem restrictions (CME-301: https://cmetaxonomy.org/entries/CME-301.html; CME-702: https://cmetaxonomy.org/entries/CME-702.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106071 · Updated 2026-10-26T11:05:39+00:00
  • nodejs.src (nodejs:26) as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs?arch=src&rpmmod=nodejs:26

    • workaround: If the Permission Model is unused, do not enable --permission. When using --allow-fs-read/--allow-fs-write, avoid wildcard grants placed as the sole root-level rule; prefer explicit directory prefixes without ambiguous wildcards (CME-1303 Application-Level Filesystem Access Confinement: https://cmetaxonomy.org/entries/CME-1303.html). Combine application allowlists with OS confinement such as SELinux or container filesystem restrictions (CME-301: https://cmetaxonomy.org/entries/CME-301.html; CME-702: https://cmetaxonomy.org/entries/CME-702.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106071 · Updated 2026-10-26T11:05:39+00:00
  • nodejs (nodejs:26) as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs?rpmmod=nodejs:26

    • workaround: If the Permission Model is unused, do not enable --permission. When using --allow-fs-read/--allow-fs-write, avoid wildcard grants placed as the sole root-level rule; prefer explicit directory prefixes without ambiguous wildcards (CME-1303 Application-Level Filesystem Access Confinement: https://cmetaxonomy.org/entries/CME-1303.html). Combine application allowlists with OS confinement such as SELinux or container filesystem restrictions (CME-301: https://cmetaxonomy.org/entries/CME-301.html; CME-702: https://cmetaxonomy.org/entries/CME-702.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106071 · Updated 2026-10-26T11:05:39+00:00
  • npm (nodejs:26) as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/npm?rpmmod=nodejs:26

    • workaround: If the Permission Model is unused, do not enable --permission. When using --allow-fs-read/--allow-fs-write, avoid wildcard grants placed as the sole root-level rule; prefer explicit directory prefixes without ambiguous wildcards (CME-1303 Application-Level Filesystem Access Confinement: https://cmetaxonomy.org/entries/CME-1303.html). Combine application allowlists with OS confinement such as SELinux or container filesystem restrictions (CME-301: https://cmetaxonomy.org/entries/CME-301.html; CME-702: https://cmetaxonomy.org/entries/CME-702.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106071 · Updated 2026-10-26T11:05:39+00:00
  • nodejs as a component of Red Hat Enterprise Linux 10 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nodejs

    Red Hat · CVE-2026-106071 · Updated 2026-10-26T11:05:39+00:00
  • nodejs-docs as a component of Red Hat Enterprise Linux 10 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nodejs-docs

    Red Hat · CVE-2026-106071 · Updated 2026-10-26T11:05:39+00:00
  • nodejs-npm as a component of Red Hat Enterprise Linux 10 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nodejs-npm

    Red Hat · CVE-2026-106071 · Updated 2026-10-26T11:05:39+00:00
  • nodejs24 as a component of Red Hat Enterprise Linux 10 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nodejs24

    Red Hat · CVE-2026-106071 · Updated 2026-10-26T11:05:39+00:00
  • nodejs24-full-i18n as a component of Red Hat Enterprise Linux 10 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nodejs24-full-i18n

    Red Hat · CVE-2026-106071 · Updated 2026-10-26T11:05:39+00:00
  • nodejs24-npm as a component of Red Hat Enterprise Linux 10 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nodejs24-npm

    Red Hat · CVE-2026-106071 · Updated 2026-10-26T11:05:39+00:00
  • nodejs-devel (nodejs:24) as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nodejs-devel?rpmmod=nodejs:24

    Red Hat · CVE-2026-106071 · Updated 2026-10-26T11:05:39+00:00
  • nodejs-docs (nodejs:24) as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nodejs-docs?rpmmod=nodejs:24

    Red Hat · CVE-2026-106071 · Updated 2026-10-26T11:05:39+00:00
  • nodejs-libs (nodejs:22) as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nodejs-libs?rpmmod=nodejs:22

    Red Hat · CVE-2026-106071 · Updated 2026-10-26T11:05:39+00:00
  • nodejs-nodemon.src (nodejs:22) as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nodejs-nodemon?arch=src&rpmmod=nodejs:22

    Red Hat · CVE-2026-106071 · Updated 2026-10-26T11:05:39+00:00
  • nodejs-nodemon (nodejs:24) as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nodejs-nodemon?rpmmod=nodejs:24

    Red Hat · CVE-2026-106071 · Updated 2026-10-26T11:05:39+00:00
  • nodejs-packaging-bundler (nodejs:24) as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nodejs-packaging-bundler?rpmmod=nodejs:24

    Red Hat · CVE-2026-106071 · Updated 2026-10-26T11:05:39+00:00
  • nodejs-packaging (nodejs:22) as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nodejs-packaging?rpmmod=nodejs:22

    Red Hat · CVE-2026-106071 · Updated 2026-10-26T11:05:39+00:00
  • nodejs.src (nodejs:22) as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nodejs?arch=src&rpmmod=nodejs:22

    Red Hat · CVE-2026-106071 · Updated 2026-10-26T11:05:39+00:00
  • nodejs (nodejs:22) as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nodejs?rpmmod=nodejs:22

    Red Hat · CVE-2026-106071 · Updated 2026-10-26T11:05:39+00:00
  • npm (nodejs:24) as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/npm?rpmmod=nodejs:24

    Red Hat · CVE-2026-106071 · Updated 2026-10-26T11:05:39+00:00
  • v8-12.4-devel (nodejs:24) as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/v8-12.4-devel?rpmmod=nodejs:24

    Red Hat · CVE-2026-106071 · Updated 2026-10-26T11:05:39+00:00
  • nodejs-docs (nodejs:22) as a component of Red Hat Enterprise Linux 9 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nodejs-docs?rpmmod=nodejs:22

    Red Hat · CVE-2026-106071 · Updated 2026-10-26T11:05:39+00:00
  • nodejs-full-i18n (nodejs:22) as a component of Red Hat Enterprise Linux 9 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nodejs-full-i18n?rpmmod=nodejs:22

    Red Hat · CVE-2026-106071 · Updated 2026-10-26T11:05:39+00:00
  • nodejs-libs (nodejs:24) as a component of Red Hat Enterprise Linux 9 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nodejs-libs?rpmmod=nodejs:24

    Red Hat · CVE-2026-106071 · Updated 2026-10-26T11:05:39+00:00
  • nodejs.src (nodejs:24) as a component of Red Hat Enterprise Linux 9 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nodejs?arch=src&rpmmod=nodejs:24

    Red Hat · CVE-2026-106071 · Updated 2026-10-26T11:05:39+00:00
  • npm (nodejs:22) as a component of Red Hat Enterprise Linux 9 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/npm?rpmmod=nodejs:22

    Red Hat · CVE-2026-106071 · Updated 2026-10-26T11:05:39+00:00
  • hi/nodejs as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/nodejs?repository_url=registry.redhat.io/hi/nodejs

    Red Hat · CVE-2026-106071 · Updated 2026-10-26T11:05:39+00:00
  • nodejs24.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nodejs24?arch=src

    Red Hat · CVE-2026-106071 · Updated 2026-10-26T11:05:39+00:00
  • nodejs26.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nodejs26?arch=src

    Red Hat · CVE-2026-106071 · Updated 2026-10-26T11:05:39+00:00

Unverified PoC candidates

Catalogue matches for further research. These repositories have not been validated as working exploits.

1 candidate

All CVSS metrics

  • LOW 3.6 v3.0 · CNA Primary
    CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N/CR:M/IR:M/AR:M
  • LOW 3.6 v3.0 · NVD Secondary
    CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

References

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS