Partial String Comparison in Node.js - CVE-2026-106071
Published: October 26, 2026
Vulnerability identifier: #VU157676
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-106071
CWE-ID: CWE-187
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to read or write filesystem paths outside the access granted by wildcard Permission Model rules.
The vulnerability exists due to incomplete path-prefix comparison in the Node.js Permission Model radix tree lookup when a requested path is shorter than the prefix of a wildcard grant. A local user can execute code that requests a shorter path to bypass filesystem restrictions; for example, --allow-fs-read=/etc/passwd.* incorrectly permits reading /etc/passwd.
The wildcard grant must sit directly under the root of the permission tree, for example when it is the only grant for that scope.
Affected software
Node.js
Anolis OS
nodejs-npm
v8-13.6-devel
nodejs
nodejs-devel
nodejs-full-i18n
nodejs-libs
nodejs-docs
Anolis OS
nodejs-npm
v8-13.6-devel
nodejs
nodejs-devel
nodejs-full-i18n
nodejs-libs
nodejs-docs
How to mitigate CVE-2026-106071
Install security update from vendor's website.
Node.js - addressed in versions 22.23.4, 24.22.1, 26.12.1
nodejs-npm - update to 11.19.1-1.24.22.1.1
v8-13.6-devel - update to 13.6.233.17-1.24.22.1.1
nodejs - update to 24.22.1-1
nodejs-devel - update to 24.22.1-1
nodejs-full-i18n - update to 24.22.1-1
nodejs-libs - update to 24.22.1-1
nodejs-docs - update to 24.22.1-1
nodejs-npm - update to 11.19.1-1.24.22.1.1
v8-13.6-devel - update to 13.6.233.17-1.24.22.1.1
nodejs - update to 24.22.1-1
nodejs-devel - update to 24.22.1-1
nodejs-full-i18n - update to 24.22.1-1
nodejs-libs - update to 24.22.1-1
nodejs-docs - update to 24.22.1-1