CVE-2026-58043: 
npm vulnerability analysis and mitigation

CVE-2026-58043 is a high-severity authorization bypass vulnerability in the Node.js Permission Model that allows filesystem access to be over-granted across radix-tree prefix boundaries. When running under the --permission flag, an attacker who has been granted access to one filesystem path can exploit boundary handling in the radix-tree implementation to read from or write to paths outside the intended allowlist. The vulnerability affects Node.js versions 22.x (≤22.23.1), 24.x (≤24.18.0), and 26.x (≤26.5.0), as well as the main development branch. It was reported by researcher sy2n0, fixed by RafaelGSS, and publicly disclosed on July 30, 2026, with a CVSS v3 base score of 7.5 (High) (Node.js Advisory, Github Advisory).

The root cause is classified as CWE-284 (Improper Access Control), specifically a flaw in how Node.js's Permission Model enforces filesystem path restrictions using a radix-tree data structure. The radix-tree is used to store and look up allowed paths, but a boundary condition in prefix matching allows a path that shares a prefix with an allowed path to be incorrectly permitted — effectively bypassing the allowlist. Exploitation requires local access and low privileges (the attacker must already have been granted access to at least one path via --permission), and the attack complexity is rated High, indicating that specific conditions or crafted path inputs must be met. The vulnerability only affects deployments that explicitly use the --permission flag; Node.js instances running without this flag are not impacted (Node.js Advisory, Github Advisory).

A local user with at least one permitted filesystem path can leverage this flaw to read from or write to arbitrary paths outside the configured allowlist, resulting in high confidentiality and integrity impact. This could allow an attacker to exfiltrate sensitive files, tamper with application data, or overwrite critical system files accessible to the Node.js process. Availability is not directly impacted by this vulnerability. The scope is rated as Changed, meaning the impact extends beyond the vulnerable component itself to other resources on the system (Github Advisory, Node.js Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of disclosure (Github Advisory). The EPSS score is approximately 0.14% (4th percentile), indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Exploitation is constrained by the requirement for local access, low privileges, and high attack complexity, limiting the practical attack surface primarily to multi-tenant or sandboxed Node.js environments using the Permission Model.

1. Identify target environment: Confirm the target Node.js application is running with the --permission flag and that the attacker has been granted access to at least one specific filesystem path (e.g., --allow-fs-read=/tmp/allowed).
2. Craft a boundary-exploiting path: Construct a filesystem path that shares a prefix with the allowed path but extends beyond it in a way that exploits the radix-tree boundary condition (e.g., if /tmp/allowed is permitted, craft a path like /tmp/allowed/../secret or a path that abuses prefix matching to reach /tmp/allowedextra or sibling directories).
3. Attempt unauthorized file access: Use Node.js file system APIs (e.g., fs.readFileSync(), fs.writeFileSync()) with the crafted path to attempt reading or writing files outside the intended allowlist.
4. Achieve unauthorized read/write: If the radix-tree boundary condition is triggered, the Permission Model incorrectly grants access, allowing the attacker to read sensitive files (e.g., credentials, configuration) or write/overwrite files outside the intended scope (Node.js Advisory, Github Advisory).

• Logs: Node.js application logs showing unexpected file access to paths outside the configured --allow-fs-read or --allow-fs-write allowlists; audit logs recording file reads/writes to sensitive directories by the Node.js process.
• File System: Unexpected modification timestamps on files outside the intended allowlist directories; presence of new or altered files in directories not covered by the --permission configuration.
• Process: Node.js processes launched with --permission flags accessing files in directories inconsistent with their configured allowlist, observable via system call tracing tools such as strace or auditd.

Node.js has released patched versions addressing this vulnerability: v22.23.2, v24.18.1, and v26.5.1. All users running affected versions (22.x ≤22.23.1, 24.x ≤24.18.0, 26.x ≤26.5.0) with the --permission flag should upgrade immediately. As a temporary workaround, administrators should review and audit filesystem permission allowlists configured with --permission to ensure they do not grant overly broad or prefix-ambiguous paths. Organizations using end-of-life Node.js versions (18.x, 20.x) should migrate to a supported release line (Node.js Advisory, Github Advisory).

The Node.js project disclosed this vulnerability as part of a broader July 2026 security release that addressed 11 CVEs across all active release lines, with multiple outlets covering the release (CyberSecurityNews, SecurityOnline). HeroDevs published a blog post summarizing the July 2026 security release and its implications for users on end-of-life Node.js versions 18 and 20 (HeroDevs). SUSE and openSUSE issued their own security advisories and package updates in response to the upstream Node.js fixes (SUSE Advisory). Community reaction has been focused on the breadth of the release rather than this specific CVE, given its local-only attack vector and high complexity.