CVE-2026-58039: Node.js Auth Bypass Vulnerability

CVE-2026-58039 Overview

CVE-2026-58039 is a permission model enforcement flaw in Node.js that allows the process.report API to write and overwrite files outside paths granted by --allow-fs-write. The flaw undermines the intended filesystem sandbox created by the experimental Permission Model. A local actor with the ability to execute code inside a restricted Node.js process can escape the write boundary and modify arbitrary files the process can reach. The issue affects Node.js 22.x, 24.x, and 26.x. It is tracked under CWE-284: Improper Access Control.

Critical Impact
Code running inside a Node.js Permission Model sandbox can bypass --allow-fs-write restrictions and overwrite files outside the allowlisted paths using process.report.

Affected Products

Node.js 22.x
Node.js 24.x
Node.js 26.x

Discovery Timeline

2026-07-31 - CVE-2026-58039 published to NVD
2026-07-31 - Last updated in NVD database

Technical Details for CVE-2026-58039

Vulnerability Analysis

The Node.js Permission Model is an experimental capability that restricts filesystem, child process, worker, and native addon access from within a running process. Operators enable it with --permission and grant filesystem write access with --allow-fs-write=<path>. The process.report API generates diagnostic reports and accepts a caller-supplied file path as the write destination.

The permission check for process.report write operations does not honor the --allow-fs-write allowlist. Callers can specify a destination outside the granted paths, and the report writer completes the operation. Existing files at the target path are overwritten because report generation truncates the destination.

Exploitation requires local code execution inside the sandboxed process. The impact is limited to file writes the underlying OS user is authorized to perform. Confidentiality can be affected when overwrites replace configuration or state that the process later reads back.

Root Cause

The root cause is missing access control [CWE-284] in the process.report write path. The report generator bypasses the Permission Model's fs.write gate that filters standard filesystem write APIs against --allow-fs-write.

Attack Vector

The attack vector is local. An attacker running JavaScript inside a Node.js process configured with --permission and a restricted --allow-fs-write set calls process.report.writeReport(<path>) with a path outside the allowlist. The runtime writes the diagnostic report to the attacker-chosen path, overwriting the existing file if present. No user interaction is required.

A verified proof of concept is not publicly available. See the Node.js Vulnerability Blog Post for vendor technical details.

Detection Methods for CVE-2026-58039

Indicators of Compromise

Unexpected Node.js diagnostic report files (typically named report.<timestamp>.<pid>.<tid>.<seq>.json) appearing outside directories granted by --allow-fs-write.
Overwritten configuration, script, or state files whose new contents match the Node.js diagnostic report JSON schema.
Calls to process.report.writeReport() in application or child-module code paths that do not legitimately require diagnostic reporting.

Detection Strategies

Audit deployed Node.js runtimes for versions in the 22.x, 24.x, and 26.x release lines and confirm whether --permission is enabled.
Enable filesystem auditing (auditd, EDR file telemetry) on hosts running permission-restricted Node.js processes and alert on writes by node outside the intended --allow-fs-write paths.
Perform static analysis of application dependencies for references to process.report.writeReport, process.report.directory, or process.report.filename.

Monitoring Recommendations

Forward Node.js process file-write events and command-line arguments to a centralized log platform and correlate write targets against declared allowlists.
Alert on new JSON files that begin with the Node.js report header fields (header, javascriptStack, nativeStack) written to sensitive directories.
Track Node.js version inventory and flag any host still running unpatched 22.x, 24.x, or 26.x builds.

How to Mitigate CVE-2026-58039

Immediate Actions Required

Upgrade Node.js to the fixed release for the affected line as published in the Node.js Vulnerability Blog Post.
Inventory workloads that rely on --permission and treat the Permission Model as defense-in-depth rather than a hard security boundary until patched.
Review application code and dependencies for calls to process.report.writeReport() and remove or gate untrusted invocations.

Patch Information

Node.js has released updated versions for the 22.x, 24.x, and 26.x lines that correctly apply --allow-fs-write enforcement to process.report write operations. Refer to the vendor advisory in the Node.js Vulnerability Blog Post for exact fixed versions and download links.

Workarounds

Disable diagnostic reporting by omitting --report-on-fatalerror, --report-on-signal, --report-uncaught-exception, and setting process.report.reportOnUncaughtException = false at startup.
Run the Node.js process under an OS-level sandbox (seccomp, AppArmor, SELinux, or container filesystem read-only mounts) that enforces write restrictions outside the Node.js Permission Model.
Restrict the OS user account under which Node.js runs so that filesystem write permissions align with the intended --allow-fs-write scope.

bash

# Configuration example: harden Node.js diagnostic reporting until patched
node \
  --permission \
  --allow-fs-read=/app \
  --allow-fs-write=/app/data \
  --report-compact \
  -e "process.report.reportOnFatalError = false; \
      process.report.reportOnSignal = false; \
      process.report.reportOnUncaughtException = false; \
      require('/app/server.js');"