- Description
- A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**.
- Source
- support@hackerone.com
- NVD status
- Analyzed
- Products
- node.js
CVSS 3.1
- Type
- Primary
- Base score
- 8.4
- Impact score
- 5.8
- Exploitability score
- 2
- Vector string
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
- Severity
- HIGH
CVSS 3.0
- Type
- Secondary
- Base score
- 7.5
- Impact score
- 5.8
- Exploitability score
- 1.1
- Vector string
- CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
- Severity
- HIGH
- support@hackerone.com
- CWE-284
- Hype score
- Not currently trending
The board never gets bigger. The tail does. 🐍 CVE-2026-58043: High-severity allowlist bypass in the Node.js Permission Model. CVSS 7.5. Grant /data/secret1, /data/secret2, /data/secret3 and the radix tree splits at /data/secret — marking that boundary granted. A file nobod
@herodevs
20 Aug 2026
165 Impressions
0 Retweets
0 Likes
0 Bookmarks
1 Reply
0 Quotes
CVE-2026-56846, CVE-2026-56848 & CVE-2026-58043 and other: 3 high-severity and 8 medium or low vulnerabilities in Node.js 🔥 Recently disclosed vulnerabilities in Node.js touch HTTP/2, the Permission Model, and several core modules. 👉 https://t.co/JHr4MEmONt https:/
@Netlas_io
30 Jul 2026
538 Impressions
3 Retweets
8 Likes
1 Bookmark
0 Replies
0 Quotes
Node.jsで11件の脆弱性が修正。うち、深刻度「高」が3件。HTTP/2におけるヒープ解放後メモリ使用CVE-2026-56848、HTTP/2のメモリ枯渇CVE-2026-56846、過剰なファイルシステムアクセス許可CVE-2026-58043。 https://t.co/W5zRutPGEV
@__kokumoto
30 Jul 2026
750 Impressions
1 Retweet
6 Likes
2 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
"matchCriteriaId": "5D5BDB63-A6E1-4131-8920-02D17B6E68E5",
"versionEndIncluding": "22.23.1",
"versionStartIncluding": "22.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
"matchCriteriaId": "9354DDC1-01A6-4F46-85A8-4A21C1A41E1F",
"versionEndIncluding": "24.18.0",
"versionStartIncluding": "24.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
"matchCriteriaId": "B2A6EA1C-9CE0-4F3F-8ED2-C3646F5DB630",
"versionEndIncluding": "26.5.0",
"versionStartIncluding": "26.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]