CVE-2026-58043

Name of the Vulnerable Software and Affected Versions Node.js versions 22.x Node.js versions 24.x Node.js versions 26.x Node.js main

Description A flaw in the Permission Model enforcement allows for the over-granting of filesystem access across radix-tree prefix boundaries. When the --permission flag is used, an attacker granted access to a specific path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. A radix-tree is a space-optimized trie data structure used for efficient searching of keys, in this case, filesystem paths.

Recommendations Update Node.js 22.x to the latest patched version. Update Node.js 24.x to version 24.18.1-1.1 or newer. Update Node.js 26.x to version 26.5.1-1.1 or newer. Update Node.js main to the latest patched version.