CVE-2026-106073: 
Node.js vulnerability analysis and mitigation

CVE-2026-106073 is an improper permission model validation vulnerability in the realpathSync function of Node.js 22.23.4 (LTS). The flaw results in incorrect filesystem path permission handling when the Node.js Permission Model is in use. It was inserted into Feedly's threat intelligence feed on October 21, 2026, and the CVE status is currently listed as Reserved, meaning full public disclosure details are still pending. Patches have been released in Node.js v22.23.4 and v24.22.1 (Node.js v22.23.4 Release, Node.js v24.22.1 Release). No CVSS score has been publicly assigned at this time.

The root cause is improper permission validation (CWE-732 or related permission-handling weakness) within the realpathSync API when Node.js is running with the experimental Permission Model enabled. The Permission Model, introduced to restrict filesystem access, fails to correctly resolve and validate the real path of a symlink or path traversal sequence in realpathSync, potentially allowing a path that should be restricted to pass the permission check. Exploitation requires local access to a system running a Node.js application that uses the Permission Model with --allow-fs-read or --allow-fs-write flags. No public technical write-up or proof-of-concept code has been identified at this time (Node.js v22.23.4 Release, CyberSecurityNews).

Successful exploitation could allow a local attacker to bypass filesystem permission restrictions enforced by the Node.js Permission Model, enabling unauthorized read or write access to files and directories that should be off-limits. This could lead to sensitive data exposure, unauthorized modification of application files, or privilege escalation within the context of the running Node.js process. The impact is limited to environments where the Node.js Permission Model is explicitly enabled; standard Node.js deployments without the Permission Model are not affected (Node.js v22.23.4 Release, CyberSecurityNews).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-106073 as of the time of this report. The CVE remains in Reserved status, and no EPSS score or CISA KEV catalog entry has been identified. Exploitation requires local access and a Node.js application specifically configured to use the experimental Permission Model, which significantly limits the attack surface (Node.js v22.23.4 Release).

Node.js has released patched versions addressing this vulnerability: v22.23.4 (LTS) and v24.22.1. Users running Node.js with the Permission Model (--experimental-permission flag) should upgrade immediately to one of these versions. As a temporary workaround, disabling the Permission Model (i.e., not using --experimental-permission) removes the vulnerable code path, though this also removes the access control protections the model provides. Upgrading to the patched release is the recommended remediation (Node.js v22.23.4 Release, Node.js v24.22.1 Release).

CyberSecurityNews covered the Node.js security update release that includes this fix, noting that Node.js released multiple security updates addressing permission model issues (CyberSecurityNews). No notable researcher commentary or significant social media discussion has been identified for this specific CVE at this time.