CVE-2026-106073

Overview

Node.js is an asynchronous, event-driven JavaScript runtime designed for building scalable network applications. Its Permission Model, enabled with the --permission flag, limits which files a process may read to the paths granted with --allow-fs-read. The built-in fs module enforces those grants before it hands a path to the native filesystem bindings written in C++.

An authorization bypass vulnerability (CVE-2026-106073) has been identified in Node.js's fs.realpathSync(). Under the Permission Model, every API that reads filesystem information is supposed to refuse paths outside the read grants. However, fs.realpathSync() did no permission check at all. It resolves a path by walking it one component at a time with a native lstat call that does not consult the Permission Model either. This is an incomplete fix of CVE-2026-21715, which added the check only to fs.realpathSync.native().

This behaviour maps to CWE-284 (Improper Access Control), the weakness assigned in the CVE record, where a product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. In Node.js, the resource is information about the filesystem outside the granted paths, which the read restriction is meant to hide.

Exploitation requires a process started with the Permission Model and a restricted --allow-fs-read, with code running inside it, such as an untrusted plugin or script. That code calls fs.realpathSync() on paths outside its grants to learn whether they exist, to resolve where they lead, and to enumerate filesystem paths. File contents are not exposed, and processes that do not use the Permission Model are not affected. The Node.js project describes the issue as affecting its supported 22.x, 24.x and 26.x lines. The same unchecked code is present in the End-of-Life 20.x line. Node.js 18.x and earlier do not ship the Permission Model and are not affected.

Details

Module Info

• Product: Node.js
• Affected packages: node (built-in fs module; lib/fs.js)
• Affected versions: >=20.0.0 <=21.7.3, >=22.0.0 <22.23.4, >=23.0.0 <=23.11.1, >=24.0.0 <24.22.1, >=25.0.0 <=25.9.0, >=26.0.0 <26.12.1
• GitHub repository: https://github.com/nodejs/node
• Published packages: https://nodejs.org/en/download
• Package manager: Not applicable; Node.js is distributed as runtime builds from nodejs.org rather than as a published npm package
• Fixed in: Node.js 22.23.4, 24.22.1, and 26.12.1; Node.js NES v20.20.5, v20.20.13, and v22.23.5

Vulnerability Info

This Low-severity vulnerability is found in realpathSync() in Node.js's fs module (lib/fs.js). The HackerOne CNA assigns a CVSS v3.0 score of 3.3, and the Node.js project also rates it Low.

The public fs APIs check permission.has('fs.read', path) before reading anything about a path, and throw ERR_ACCESS_DENIED when the path is outside the grants. fs.lstatSync(), for example, makes that check in JavaScript before calling the native lstat binding, which has no check of its own. In the vulnerable implementation, realpathSync() validates and resolves the path and then goes straight to that native binding.

Each component of the path is passed to binding.lstat() in turn. A path that does not exist throws ENOENT, while one that exists returns its canonical form, so the call works as an existence oracle for any path on the system. The CVE record adds that the same walk can be used to resolve symbolic link targets outside the permitted directories. The CVE-2026-21715 fix added a check to the native realpath binding used by fs.realpathSync.native(), but not to this JavaScript implementation.

An attacker would need to run code inside a Node.js process restricted with --allow-fs-read and call fs.realpathSync() on paths outside the grants.

Mitigation

Node.js 22.x, 24.x and 26.x are supported and are fixed in 22.23.4, 24.22.1 and 26.12.1 and later. The End-of-Life lines that include the Permission Model never received an upstream fix. Node.js 20.x reached End-of-Life on April 30, 2026; Node.js 21.x on June 1, 2024; Node.js 23.x on June 1, 2025; and Node.js 25.x on June 1, 2026. For more information see the Node.js previous releases schedule.

Users of the affected components should apply one of the following mitigations:

• Upgrade to Node.js 22.23.4, 24.22.1 or 26.12.1 or later on those lines, all of which include this fix.
• Migrate affected applications away from the End-of-Life Node.js release lines.
• Leverage a commercial support partner like HeroDevs for post-EOL security support, through Node.js NES.

Credits

• 0xoroot (reporter)
• RafaelGSS (remediation developer)