CVE-2026-58043: 
Node.js Analyse et atténuation des vulnérabilités

CVE-2026-58043 is a high-severity authorization bypass vulnerability in the Node.js Permission Model, titled "Permission Model path matching can over-grant filesystem access." A flaw in radix-tree prefix boundary handling under the --permission flag allows a local attacker granted access to one filesystem path to read from or write to paths outside the intended allowlist. It affects Node.js 22.x (≤22.23.1), 24.x (≤24.18.0), and 26.x (≤26.5.0), as well as the main branch. The vulnerability was reported by researcher sy2n0, fixed by RafaelGSS, and publicly disclosed on July 30, 2026. It carries a CVSS v3.0 base score of 7.5 (High), assigned by HackerOne (Node.js Advisory, GitHub Advisory).

The root cause is improper access control (CWE-284) in Node.js's Permission Model, which uses a radix tree to enforce filesystem path allowlists specified via the --permission flag. The radix-tree implementation incorrectly handles prefix boundaries, meaning a path granted in the allowlist can be leveraged to match — and thus permit access to — sibling or parent paths that share a common prefix but were not explicitly authorized. Exploitation requires local access with low privileges and high attack complexity, and no user interaction. The scope change (S:C) in the CVSS vector reflects that the impact extends beyond the sandboxed component to the broader filesystem (Node.js Advisory, GitHub Advisory).

Successful exploitation allows a local attacker with limited filesystem permissions to read from or write to arbitrary paths outside the configured allowlist, resulting in high confidentiality and high integrity impact. This could expose sensitive files (credentials, configuration, private keys) or allow unauthorized modification of application or system files. Availability is not directly impacted, but unauthorized write access could facilitate persistence, privilege escalation, or lateral movement within the host environment (Node.js Advisory, GitHub Advisory).

1. Identify target: Confirm the target Node.js application runs with the --permission flag and has at least one --allow-fs-read or --allow-fs-write path configured (e.g., --allow-fs-read=/tmp/allowed).
2. Analyze allowlist: Determine the exact path(s) granted in the allowlist. Identify sibling or parent paths that share a common prefix with the allowed path (e.g., /tmp/allowed2 or /tmp/allowed-secret).
3. Craft path traversal via prefix boundary: Construct a filesystem access request using a path that exploits the radix-tree prefix boundary flaw — for example, accessing /tmp/allowed-secret when only /tmp/allowed is permitted, relying on the prefix match bug to grant access.
4. Read or write target path: Use Node.js file system APIs (e.g., fs.readFileSync, fs.writeFileSync) within the permitted execution context to access the out-of-allowlist path, bypassing the Permission Model enforcement.
5. Exfiltrate or modify data: Read sensitive files (e.g., credentials, private keys) or write malicious content to files outside the intended sandbox (Node.js Advisory).

• Logs: Node.js application logs showing filesystem access to paths not explicitly listed in the --allow-fs-read or --allow-fs-write allowlist; unexpected file read/write operations in process-level audit logs.
• File System: Unexpected modification timestamps on files outside the configured allowlist directories; new or altered files in sensitive directories (e.g., /etc, /home, application config directories) by the Node.js process user.
• Process: Node.js processes launched with --permission flag accessing filesystem paths that share a prefix with but differ from the explicitly allowed paths; unusual file descriptors opened by the Node.js process as observed via lsof or /proc/<pid>/fd.

Upgrade Node.js to the patched versions: v22.23.2, v24.18.1, or v26.5.1, which contain the fix for this vulnerability (Node.js Advisory). As a temporary workaround, review and tighten filesystem allowlists configured with --permission to avoid granting access to paths whose prefixes could match unintended sibling paths. Organizations should also audit all applications using the Node.js Permission Model to ensure allowlists are as restrictive as possible until patching is complete.

The Node.js July 2026 security release addressed 11 CVEs across all active release lines, with CVE-2026-58043 being one of three High-severity issues. Security news outlets including CyberSecurityNews, SecurityOnline, and CyberPress covered the broader release, noting the significance of the batch fix (CyberSecurityNews, SecurityOnline). Tenable added detection support via Nessus plugin 330668 shortly after disclosure. The release was delayed twice due to infrastructure issues and additional testing requirements before the final July 29, 2026 publication (Node.js Advisory).