CVE-2026-58043: Node.js Privilege Escalation Vulnerability

CVE-2026-58043 Overview

CVE-2026-58043 is a permission bypass vulnerability in the Node.js Permission Model. The flaw stems from improper enforcement of filesystem boundaries within the radix-tree data structure used to track allowed paths. An attacker granted access to one path under --permission can traverse prefix boundaries to reach paths outside the intended allowlist. The vulnerability affects Node.js main, 22.x, 24.x, and 26.x release lines. Node.js maintainers addressed the issue in the July 2026 security releases.

Critical Impact
Attackers with limited filesystem access under the Permission Model can read from and write to files outside the granted allowlist, breaking a core sandboxing guarantee.

Affected Products

Node.js main branch
Node.js 22.x release line
Node.js 24.x release line
Node.js 26.x release line

Discovery Timeline

2026-07-30 - CVE-2026-58043 published to the National Vulnerability Database (NVD)
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-58043

Vulnerability Analysis

The Node.js Permission Model, enabled via the --permission command-line flag, restricts a running process to a defined set of filesystem paths. The model relies on a radix-tree structure to store allowed prefixes and evaluate access checks at runtime. The vulnerability lies in how the tree handles boundaries between sibling prefixes. When a permission check crosses these prefix boundaries, the logic can incorrectly classify an out-of-scope path as allowed. This is categorized as an improper access control weakness [CWE-284].

Because the flaw resides in enforcement logic rather than input parsing, standard path normalization defenses do not mitigate it. The impact extends to any Node.js application that depends on the Permission Model as a sandbox against untrusted code, plugins, or dependencies.

Root Cause

The root cause is incorrect boundary handling in the radix-tree lookup used by the Permission Model. Adjacent prefixes sharing partial string components are not distinguished cleanly during traversal. An allowed path such as /var/app/data can be manipulated so the tree walk resolves to a neighboring node covering paths like /var/app/data-secret. The enforcement code treats the resolved node as authoritative and grants access.

Attack Vector

Exploitation requires local access and low privileges on a system running Node.js under --permission. An attacker who can influence file paths passed to fs operations, either through application input or code execution within the sandboxed context, can craft paths that traverse the prefix boundary. Successful exploitation yields read and write access to files outside the intended allowlist without triggering permission errors. See the Node.js Security Release Blog for maintainer-provided details.

Detection Methods for CVE-2026-58043

Indicators of Compromise

Node.js process accessing filesystem paths outside its documented --allow-fs-read or --allow-fs-write allowlist.
Unexpected file reads or writes near the string boundaries of allowed prefixes, such as sibling directories sharing a common parent.
Absence of ERR_ACCESS_DENIED errors in application logs when accesses to non-allowlisted paths occur.

Detection Strategies

Audit Node.js runtime versions across the environment and flag hosts running vulnerable 22.x, 24.x, or 26.x builds.
Correlate process filesystem telemetry with the declared Permission Model policy to surface accesses that should have been blocked.
Review application logs for fs operations targeting paths adjacent to allowlisted prefixes.

Monitoring Recommendations

Enable filesystem auditing on directories neighboring Permission Model allowlists.
Track invocations of Node.js processes with --permission flags and record the associated --allow-fs-* arguments for policy comparison.
Alert on file access patterns from Node.js processes that deviate from established baselines.

How to Mitigate CVE-2026-58043

Immediate Actions Required

Upgrade Node.js to the patched releases published in the July 2026 security releases for the 22.x, 24.x, and 26.x lines.
Inventory all applications relying on --permission as a security boundary and prioritize their update.
Review Permission Model policies and tighten allowlists to the minimum required paths.

Patch Information

Node.js maintainers released fixed builds for the 22.x, 24.x, and 26.x lines as part of the July 2026 security releases. Details, download links, and version numbers are available in the Node.js Security Release Blog.

Workarounds

Avoid relying on the Permission Model as the sole boundary for untrusted code until patched builds are deployed.
Isolate Node.js workloads inside operating-system-level sandboxes such as containers, seccomp profiles, or mandatory access control policies.
Restructure allowlist paths so sibling directories do not share partial prefixes with sensitive locations.

bash

# Configuration example: run Node.js with a tightly scoped Permission Model policy
node --permission \
     --allow-fs-read=/srv/app/public/ \
     --allow-fs-write=/srv/app/tmp/ \
     server.js