Improper access control in Node.js - CVE-2026-58043
Published: July 29, 2026 / Updated: July 29, 2026
Vulnerability identifier: #VU140040
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-58043
CWE-ID: CWE-284
Exploitation vector: Local access
Exploit availability:
No public exploit available
Affected software:
Node.js
Node.js
Detailed vulnerability description
The vulnerability allows a local user to read from or write to paths outside the intended filesystem allowlist.
The vulnerability exists due to improper access control in Node.js Permission Model path matching when handling radix-tree prefix boundaries under --permission. A local user can abuse prefix boundary handling to read from or write to paths outside the intended filesystem allowlist.
The issue applies only when the Permission Model is enabled with --permission.
How to mitigate CVE-2026-58043
Install security update from vendor's website.