Upstream information

CVE-2026-106071 at MITRE

Description

A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule.

When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, `--allow-fs-read=/etc/passwd.*` also allows reading `/etc/passwd`. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043.

This vulnerability affects Node.js **26.x**.

SUSE information

Overall state of this security issue: Resolved

This issue is currently not rated by SUSE as it is not affecting the SUSE Enterprise products.

CVSS v3 Scores
CVSS detail CNA (HackerOne)
Base Score 3.6
Vector CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack Vector Local
Attack Complexity High
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality Impact Low
Integrity Impact Low
Availability Impact None
CVSSv3 Version 3
SUSE Bugzilla entry: 1286569 [NEW]

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
SUSE Liberty Linux 8
  • nodejs >= 1:24.22.1-1.module+el8.10.0+25218+d9e131cb
  • nodejs-devel >= 1:24.22.1-1.module+el8.10.0+25218+d9e131cb
  • nodejs-docs >= 1:24.22.1-1.module+el8.10.0+25218+d9e131cb
  • nodejs-full-i18n >= 1:24.22.1-1.module+el8.10.0+25218+d9e131cb
  • nodejs-libs >= 1:24.22.1-1.module+el8.10.0+25218+d9e131cb
  • nodejs-nodemon >= 3.1.14-2.module+el8.10.0+24711+b610b202
  • nodejs-packaging >= 2021.06-6.module+el8.10.0+24711+b610b202
  • nodejs-packaging-bundler >= 2021.06-6.module+el8.10.0+24711+b610b202
  • npm >= 1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb
  • v8-13.6-devel >= 3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb
 Patchnames:
RHSA-2026:92376 (x86_64)
SUSE Liberty Linux 9
  • nodejs >= 1:24.22.1-3.module+el9.8.0+25216+afa2a4a4
  • nodejs-devel >= 1:24.22.1-3.module+el9.8.0+25216+afa2a4a4
  • nodejs-docs >= 1:24.22.1-3.module+el9.8.0+25216+afa2a4a4
  • nodejs-full-i18n >= 1:24.22.1-3.module+el9.8.0+25216+afa2a4a4
  • nodejs-libs >= 1:24.22.1-3.module+el9.8.0+25216+afa2a4a4
  • nodejs-nodemon >= 3.1.14-3.module+el9.8.0+24708+e71d2e1d
  • nodejs-packaging >= 2021.06-6.module+el9.8.0+24708+e71d2e1d
  • nodejs-packaging-bundler >= 2021.06-6.module+el9.8.0+24708+e71d2e1d
  • npm >= 1:11.19.1-1.24.22.1.3.module+el9.8.0+25216+afa2a4a4
  • v8-13.6-devel >= 3:13.6.233.17-1.24.22.1.3.module+el9.8.0+25216+afa2a4a4
 Patchnames:
RHSA-2026:92378 (x86_64)

SUSE Timeline for this CVE

CVE page created: Wed Oct 21 19:57:41 2026
CVE page last modified: Mon Nov 2 20:58:05 2026