Vulnerability intelligence
CVE-2026-58043
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This vulnerability affects Node.js main, 22.x, 24.x, and 26.x.
CVSS Score
7.5
High
EPSS — Exploit Probability
0.2%
Riskier than 4% of all CVEs · checked 2026-10-16
Exploitation
Not in CISA KEV
KEV does not include every exploited vulnerability
Remediation
unknown
Check vendor advisories
No linked coverage yet. CyberSIXT tracks this CVE and coverage will appear here.