Missing Authorization in Node.js - CVE-2026-106073

Vulnerability identifier: #VU157677

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-106073

CWE-ID: CWE-862

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to disclose filesystem path information outside directories permitted by the Node.js Permission Model.

The vulnerability exists due to missing read authorization checks in Node.js fs.realpathSync() when code runs under --permission with restricted --allow-fs-read settings. A local user can invoke fs.realpathSync() on paths outside permitted directories to check file existence, resolve symlink targets, and enumerate filesystem paths.

Node.js
Anolis OS
nodejs-npm
v8-13.6-devel
nodejs
nodejs-devel
nodejs-full-i18n
nodejs-libs
nodejs-docs

Install security update from vendor's website.

Node.js - addressed in versions 22.23.4, 24.22.1, 26.12.1
nodejs-npm - update to 11.19.1-1.24.22.1.1
v8-13.6-devel - update to 13.6.233.17-1.24.22.1.1
nodejs - update to 24.22.1-1
nodejs-devel - update to 24.22.1-1
nodejs-full-i18n - update to 24.22.1-1
nodejs-libs - update to 24.22.1-1
nodejs-docs - update to 24.22.1-1

• https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

• Multiple vulnerabilities in Node.js
• Anolis OS update for nodejs