{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-58043", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "state": "PUBLISHED", "assignerShortName": "hackerone", "dateReserved": "2026-06-27T15:00:00.780Z", "datePublished": "2026-07-30T06:02:50.095Z", "dateUpdated": "2026-07-31T03:55:48.673Z"}, "containers": {"cna": {"descriptions": [{"lang": "en", "value": "A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.\r\n\r\nUnder `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist.\r\n\r\nThis vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**."}], "affected": [{"defaultStatus": "unaffected", "vendor": "nodejs", "product": "node", "versions": [{"version": "22.23.1", "status": "affected", "lessThanOrEqual": "22.23.1", "versionType": "semver"}, {"version": "24.18.0", "status": "affected", "lessThanOrEqual": "24.18.0", "versionType": "semver"}, {"version": "26.5.0", "status": "affected", "lessThanOrEqual": "26.5.0", "versionType": "semver"}]}], "references": [{"url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"}], "metrics": [{"cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control - Generic"}]}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2026-07-30T06:02:50.095Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-30T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-58043"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-31T03:55:48.673Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-58043", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-30T12:35:59.943143Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-30T12:36:07.155Z"}}], "cna": {"metrics": [{"cvssV3_0": {"version": "3.0", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N"}}], "affected": [{"vendor": "nodejs", "product": "node", "versions": [{"status": "affected", "version": "22.23.1", "versionType": "semver", "lessThanOrEqual": "22.23.1"}, {"status": "affected", "version": "24.18.0", "versionType": "semver", "lessThanOrEqual": "24.18.0"}, {"status": "affected", "version": "26.5.0", "versionType": "semver", "lessThanOrEqual": "26.5.0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"}], "descriptions": [{"lang": "en", "value": "A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.\r\n\r\nUnder `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist.\r\n\r\nThis vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control - Generic"}]}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2026-07-30T06:02:50.095Z"}}}, "cveMetadata": {"cveId": "CVE-2026-58043", "state": "PUBLISHED", "dateUpdated": "2026-07-31T03:55:48.673Z", "dateReserved": "2026-06-27T15:00:00.780Z", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "datePublished": "2026-07-30T06:02:50.095Z", "assignerShortName": "hackerone"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "node", "vendor": "nodejs", "versions": [{"lessThanOrEqual": "22.23.1", "status": "affected", "version": "22.23.1", "versionType": "semver"}, {"lessThanOrEqual": "24.18.0", "status": "affected", "version": "24.18.0", "versionType": "semver"}, {"lessThanOrEqual": "26.5.0", "status": "affected", "version": "26.5.0", "versionType": "semver"}]}], "source": "support@hackerone.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.\r\n\r\nUnder `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist.\r\n\r\nThis vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**."}], "id": "CVE-2026-58043", "lastModified": "2026-07-31T04:17:23.737", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "version": "3.0"}, "exploitabilityScore": 1.1, "impactScore": 5.8, "source": "support@hackerone.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58043", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-30T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-07-30T06:25:55.310", "references": [{"source": "support@hackerone.com", "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"}], "sourceIdentifier": "support@hackerone.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "support@hackerone.com", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2026:48305", "cpe": "cpe:/a:redhat:hummingbird:1", "impact": "important", "package": "nodejs22-main-22.23.2-2.3.hum1", "product_name": "Red Hat Hardened Images", "release_date": "2026-07-29T00:00:00Z"}, {"advisory": "RHSA-2026:48537", "cpe": "cpe:/a:redhat:hummingbird:1", "impact": "important", "package": "nodejs24-main-24.18.1-0.1.hum1", "product_name": "Red Hat Hardened Images", "release_date": "2026-07-30T00:00:00Z"}], "bugzilla": {"description": "nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw", "id": "2509171", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509171"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "status": "verified"}, "cwe": "CWE-551", "details": ["A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.\nUnder `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist.\nThis vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**.", "A flaw was found in Node.js. When the `--permission` flag is active, an attacker with limited file system access can exploit a vulnerability in the Permission Model's enforcement. This allows them to read from or write to files and directories that are outside of their authorized access, potentially leading to unauthorized information disclosure or data modification."], "name": "CVE-2026-58043", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Will not fix", "impact": "important", "package_name": "nodejs20", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Will not fix", "impact": "important", "package_name": "nodejs25", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "impact": "important", "package_name": "nodejs26", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-07-30T06:02:50Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-58043\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-58043\nhttps://nodejs.org/en/blog/vulnerability/july-2026-security-releases"], "threat_severity": "Important"}