CVE-2026-58043

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-58043", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "state": "PUBLISHED", "assignerShortName": "hackerone", "dateReserved": "2026-06-27T15:00:00.780Z", "datePublished": "2026-07-30T06:02:50.095Z", "dateUpdated": "2026-07-31T03:55:48.673Z"}, "containers": {"cna": {"descriptions": [{"lang": "en", "value": "A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.\r\n\r\nUnder `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist.\r\n\r\nThis vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**."}], "affected": [{"defaultStatus": "unaffected", "vendor": "nodejs", "product": "node", "versions": [{"version": "22.23.1", "status": "affected", "lessThanOrEqual": "22.23.1", "versionType": "semver"}, {"version": "24.18.0", "status": "affected", "lessThanOrEqual": "24.18.0", "versionType": "semver"}, {"version": "26.5.0", "status": "affected", "lessThanOrEqual": "26.5.0", "versionType": "semver"}]}], "references": [{"url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"}], "metrics": [{"cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control - Generic"}]}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2026-07-30T06:02:50.095Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-30T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-58043"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-31T03:55:48.673Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-58043", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-30T12:35:59.943143Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-30T12:36:07.155Z"}}], "cna": {"metrics": [{"cvssV3_0": {"version": "3.0", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N"}}], "affected": [{"vendor": "nodejs", "product": "node", "versions": [{"status": "affected", "version": "22.23.1", "versionType": "semver", "lessThanOrEqual": "22.23.1"}, {"status": "affected", "version": "24.18.0", "versionType": "semver", "lessThanOrEqual": "24.18.0"}, {"status": "affected", "version": "26.5.0", "versionType": "semver", "lessThanOrEqual": "26.5.0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"}], "descriptions": [{"lang": "en", "value": "A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.\r\n\r\nUnder `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist.\r\n\r\nThis vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control - Generic"}]}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2026-07-30T06:02:50.095Z"}}}, "cveMetadata": {"cveId": "CVE-2026-58043", "state": "PUBLISHED", "dateUpdated": "2026-07-31T03:55:48.673Z", "dateReserved": "2026-06-27T15:00:00.780Z", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "datePublished": "2026-07-30T06:02:50.095Z", "assignerShortName": "hackerone"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "node", "vendor": "nodejs", "versions": [{"lessThanOrEqual": "22.23.1", "status": "affected", "version": "22.23.1", "versionType": "semver"}, {"lessThanOrEqual": "24.18.0", "status": "affected", "version": "24.18.0", "versionType": "semver"}, {"lessThanOrEqual": "26.5.0", "status": "affected", "version": "26.5.0", "versionType": "semver"}]}], "source": "support@hackerone.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "matchCriteriaId": "5D5BDB63-A6E1-4131-8920-02D17B6E68E5", "versionEndIncluding": "22.23.1", "versionStartIncluding": "22.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "matchCriteriaId": "9354DDC1-01A6-4F46-85A8-4A21C1A41E1F", "versionEndIncluding": "24.18.0", "versionStartIncluding": "24.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "matchCriteriaId": "B2A6EA1C-9CE0-4F3F-8ED2-C3646F5DB630", "versionEndIncluding": "26.5.0", "versionStartIncluding": "26.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.\r\n\r\nUnder `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist.\r\n\r\nThis vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**."}, {"lang": "es", "value": "Un fallo en la aplicaci\u00f3n del Modelo de Permisos de Node.js puede otorgar en exceso acceso al sistema de archivos a trav\u00e9s de los l\u00edmites de prefijo del \u00e1rbol radix.\n\nBajo \u201c--permission\u201d, un atacante a quien se le concede acceso a una ruta puede abusar del manejo de l\u00edmites para leer o escribir en rutas fuera de la lista de permitidos del sistema de archivos prevista.\n\nEsta vulnerabilidad afecta a Node.js main, 22.x, 24.x y 26.x."}], "id": "CVE-2026-58043", "lastModified": "2026-10-23T22:10:00.160", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "version": "3.0"}, "exploitabilityScore": 1.1, "impactScore": 5.8, "source": "support@hackerone.com", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 5.8, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58043", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-30T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-07-30T06:25:55.310", "references": [{"source": "support@hackerone.com", "tags": ["Vendor Advisory"], "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"}], "sourceIdentifier": "support@hackerone.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "support@hackerone.com", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2026:48305", "cpe": "cpe:/a:redhat:hummingbird:1", "impact": "important", "package": "nodejs22-main-22.23.2-2.3.hum1", "product_name": "Red Hat Hardened Images", "release_date": "2026-07-29T00:00:00Z"}, {"advisory": "RHSA-2026:48537", "cpe": "cpe:/a:redhat:hummingbird:1", "impact": "important", "package": "nodejs24-main-24.18.1-0.1.hum1", "product_name": "Red Hat Hardened Images", "release_date": "2026-07-30T00:00:00Z"}], "bugzilla": {"description": "nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw", "id": "2509171", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509171"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "status": "verified"}, "cwe": "CWE-551", "details": ["A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.\nUnder `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist.\nThis vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**.", "A flaw was found in Node.js. When the `--permission` flag is active, an attacker with limited file system access can exploit a vulnerability in the Permission Model's enforcement. This allows them to read from or write to files and directories that are outside of their authorized access, potentially leading to unauthorized information disclosure or data modification."], "name": "CVE-2026-58043", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Will not fix", "impact": "important", "package_name": "nodejs20", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Will not fix", "impact": "important", "package_name": "nodejs25", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "impact": "important", "package_name": "nodejs26", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-07-30T06:02:50Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-58043\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-58043\nhttps://nodejs.org/en/blog/vulnerability/july-2026-security-releases"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[22.23.1,22.23.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[24.18.0,24.18.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[26.5.0,26.5.0]"}}], "enrichment": {"confidence": 92.0, "confidence_source": "matching", "scores": [{"score": 92.0, "source": "matching"}]}, "original": {"product": "node", "source": "cna", "vendor": "nodejs"}, "product": "nodejs", "vendor": "nodejs"}], "created": "2026-07-30T13:30:04.209820+00:00", "updated": "2026-08-26T04:45:05.090442+00:00", "vendors": ["nodejs", "nodejs$PRODUCT$nodejs"]}