EOL Fix Available | CVE-2026-58043

Overview

Node.js is a JavaScript runtime built on the V8 JavaScript engine. It uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, and it is widely used to build scalable server-side and networking applications.

An improper access control vulnerability (CVE-2026-58043) has been identified in the Node.js Permission Model, the opt-in sandbox enabled with the --permission flag. Path matching over-grants filesystem access across radix-tree prefix boundaries, so code that was granted access to one path can read from or write to paths outside the intended filesystem allowlist.

Per MITRE CWE-284: "The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor." Here the restriction exists and runs, but reaches the wrong answer for paths that share a character prefix with an allowed path.

This issue affects all users on the active 22.x, 24.x, and 26.x release lines below the patched versions, and the End-of-Life 20.x line. Node.js 18.x and earlier do not ship the Permission Model and are not affected.

Details

Module Info

Product: Node.js
Affected packages: nodejs/node (the Node.js runtime itself)
Affected versions:
- 22.x <= 22.23.1
- 24.x <= 24.18.0
- 26.x <= 26.5.0
- 20.x (End-of-Life, all versions)
GitHub repository: https://github.com/nodejs/node
Published packages: https://github.com/nodejs/node/releases
Package manager: n/a (Node.js ships as a runtime distribution rather than a registry package)
Fixed in: Node.js NES v20.20.4

Vulnerability Info

This High-severity vulnerability is found in the permission subsystem of the Node.js runtime, and is only reachable when the process is started with the --permission flag.

The Permission Model was introduced in Node.js 20 and lets an operator restrict what a process may touch on disk. Filesystem access is granted with --allow-fs-read and --allow-fs-write, each taking one or more paths. Internally the runtime stores those granted paths in a radix tree so that an access check is a fast prefix walk rather than a scan of every rule. A radix tree stores shared prefixes once and splits a node when two stored paths diverge part-way through.

In affected versions the nodes created by those splits were themselves treated as granted. Because a split can fall in the middle of a path segment rather than on a directory boundary, a grant could leak to paths that merely share a leading substring with an allowed path instead of being contained within it. Code running inside the sandbox that already holds one grant can use this to read from or write to locations the operator never allowed. The CVSS vector reflects the shape of the attack: local vector, high attack complexity, low privileges required, and a changed scope, with high confidentiality and integrity impact and no availability impact.

The upstream fix (commit 440329f624, "permission: avoid granting radix split nodes") stops the split nodes from carrying a grant.

Note: The Permission Model is opt-in. Applications that do not run with --permission enforce no filesystem allowlist in the first place and are not affected by this issue. Node.js 18.x and earlier are likewise unaffected, because the Permission Model did not exist before Node.js 20.

Mitigation

The Node.js 20 release line is past its End-of-Life date and will not receive an upstream fix for this issue. For more information see here.

Users of the affected components should apply one of the following mitigations:

Upgrade to a currently supported Node.js release line at or above the patched version (22.23.2, 24.18.1, or 26.5.1).
Migrate affected applications away from the End-of-Life Node.js 20 release line.
Leverage a commercial support partner like HeroDevs for post-EOL security support.