CVE-2026-58043
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. An attacker with access to one path can abuse boundary handling to read or write paths outside the intended filesystem allowlist. This affects Node.js main, 22.x, 24.x, and 26.x.
Risk Assessment
Risk of unauthorized file access beyond the allowed scope, potentially leading to data leakage or modification of critical system files.
Recommendation
Update Node.js to a version that fixes this vulnerability and review the permission model configuration carefully.
Other vulnerabilities in Node.js
See all- CVE-2026-21637High
A vulnerability in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths, leading to immediate process termination or silent file descriptor leaks that eventually cause denial of service.
- CVE-2025-59466High
A bug has been identified in Node.js error handling where 'Maximum call stack size exceeded' errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications relying on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
- CVE-2025-59464High
A memory leak in Node.js's OpenSSL integration occurs when converting X.509 certificate fields to UTF-8 without freeing the allocated buffer. Applications calling socket.getPeerCertificate(true) leak memory per certificate field, allowing remote clients to trigger steady memory growth through repeated TLS connections.
- CVE-2015-7384High
Node.js versions 4.0.0, 4.1.0, and 4.1.1 allow remote attackers to cause a denial of service.
- CVE-2017-14849High
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to '..' handling was incompatible with the pathname validation used by unspecified community modules.
- CVE-2017-11499High
Node.js versions from 4.0 to 4.8.3, all 5.x versions, and versions 6.0 to 6.11.0, 7.0 to 7.10.0, and 8.0 to 8.1.3 were susceptible to hash flooding DoS attacks. This was due to the HashTable seed being constant across a given released version of Node.js.
- CVE-2016-2216High
The HTTP header parsing code in Node.js in versions 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header.
- CVE-2016-2086High
Node.js versions 0.10.x before 0.10.42, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 are vulnerable to HTTP request smuggling attacks via a crafted Content-Length HTTP header.
- CVE-2015-8027High
Node.js versions 0.12.x before 0.12.9, 4.x before 4.2.3, and 5.x before 5.1.1 do not ensure the availability of a parser for each HTTP socket, allowing remote attackers to cause a denial of service via a pipelined HTTP request.
- CVE-2026-21710High
A flaw in Node.js HTTP request handling causes an uncaught TypeError when a request with a header named __proto__ is received and the application accesses req.headersDistinct. The exception is thrown synchronously inside a property getter and cannot be intercepted by error event listeners.
Original NVD description (English source)
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**.