Every CVE Search/ Get API key

CVE-2026-106071

A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not...

3.6 LowPublic exploitFix available

A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard --allow-fs-read or --allow-fs-write rule.

When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, --allow-fs-read=/etc/passwd.* also allows reading /etc/passwd. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043.

This vulnerability affects Node.js 26.x.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.20%Up 0.1 points since Oct 24, 2026
90%50%10%1%

What each source reports

CVE List Score used 3.6

A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard --allow-fs-read or --allow-fs-write rule.

When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, --allow-fs-read=/etc/passwd.* also allows reading /etc/passwd. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043.

This vulnerability affects Node.js 26.x.

Record
CVE-2026-106071
CVSS 3.0
3.6 LowCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N/CR:M/IR:M/AR:M
Weakness
CWE-284
Updated
2026-11-02
EUVDEUVD-2026-109103 3.6

A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard --allow-fs-read or --allow-fs-write rule.

When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, --allow-fs-read=/etc/passwd.* also allows reading /etc/passwd. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043.

This vulnerability affects Node.js 26.x.

Record
EUVD-2026-109103
CVSS 3.0
3.6 LowCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N/CR:M/IR:M/AR:M
Updated
2026-11-03
GitHub AdvisoriesGHSA-jjjg-m7c2-q32j 3.6

A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not...

A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard --allow-fs-read or --allow-fs-write rule.

When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, --allow-fs-read=/etc/passwd.* also allows reading /etc/passwd. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043.

This vulnerability affects Node.js 26.x.

Record
GHSA-jjjg-m7c2-q32j
CVSS 3.0
3.6 LowCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-284
Updated
2026-11-02
NVD 3.6

A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard --allow-fs-read or --allow-fs-write rule.

When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, --allow-fs-read=/etc/passwd.* also allows reading /etc/passwd. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043.

This vulnerability affects Node.js 26.x.

Record
CVE-2026-106071
CVSS 3.0
3.6 LowCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-284
Updated
2026-11-02
OSVALPINE-CVE-2026-106071 3.6

A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard --allow-fs-read or --allow-fs-write rule.

When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, --allow-fs-read=/etc/passwd.* also allows reading /etc/passwd. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043.

This vulnerability affects Node.js 26.x.

Record
ALPINE-CVE-2026-106071
CVSS 3.0
3.6 LowCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-03
OSVBELL-CVE-2026-106071 3.6
Record
BELL-CVE-2026-106071
CVSS 3.0
3.6 LowCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
Show 8 moreShow less
OSVRLSA-2026:92376 8.1

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)

  • brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)

  • brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)

  • brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)

  • brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)

  • nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)

  • nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)

  • nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)

  • nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)

  • nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)

  • nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)

  • nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)

  • nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:Rocky Linux-289763)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:92376
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:92378 8.1

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)

  • brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)

  • brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)

  • brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)

  • brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)

  • nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)

  • nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)

  • nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)

  • nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)

  • nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)

  • nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)

  • nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)

  • nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:Rocky Linux-293233)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:92378
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-106071 3.6

A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard --allow-fs-read or --allow-fs-write rule. When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, --allow-fs-read=/etc/passwd.* also allows reading /etc/passwd. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043. This vulnerability affects Node.js 26.x.

Record
UBUNTU-CVE-2026-106071
CVSS 3.0
3.6 LowCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVALSA-2026:92376 No score

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)
  • brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)
  • brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)
  • brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)
  • brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)
  • nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)
  • nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)
  • nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)
  • nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)
  • nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)
  • nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)
  • nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)
  • nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:RHEL-289763)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:92376
Updated
2026-11-02
OSVALSA-2026:92378 No score

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)
  • brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)
  • brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)
  • brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)
  • brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)
  • nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)
  • nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)
  • nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)
  • nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)
  • nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)
  • nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)
  • nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)
  • nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:RHEL-293233)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:92378
Updated
2026-11-02
OSVAZL-111023 No score

CVE-2026-106071 affecting package nodejs for versions less than 24.22.1-0

A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard --allow-fs-read or --allow-fs-write rule.

When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, --allow-fs-read=/etc/passwd.* also allows reading /etc/passwd. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043.

This vulnerability affects Node.js 26.x.

Record
AZL-111023
Updated
2026-11-05
OSVBIT-node-2026-106071 No score

A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard --allow-fs-read or --allow-fs-write rule.

When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, --allow-fs-read=/etc/passwd.* also allows reading /etc/passwd. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043.

This vulnerability affects Node.js 26.x.

Record
BIT-node-2026-106071
Updated
2026-11-02
OSVBIT-node-min-2026-106071 No score

A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard --allow-fs-read or --allow-fs-write rule.

When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, --allow-fs-read=/etc/passwd.* also allows reading /etc/passwd. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043.

This vulnerability affects Node.js 26.x.

Record
BIT-node-min-2026-106071
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nodejs
Alpine:v3.23
 before 24.22.1-r0
24.22.1-r0
nodejs
Alpine:v3.24
 before 24.22.1-r0
24.22.1-r0
nodejs-current
Alpine:v3.24
 before 26.12.1-r0
26.12.1-r0
nodejs
AlmaLinux:8
From an advisory covering 13 CVEs
 before 1:24.22.1-1.module_el8.10.0+4331+0683c9c1
1:24.22.1-1.module_el8.10.0+4331+0683c9c1
nodejs-devel
AlmaLinux:8
From an advisory covering 13 CVEs
 before 1:24.22.1-1.module_el8.10.0+4331+0683c9c1
1:24.22.1-1.module_el8.10.0+4331+0683c9c1
nodejs-docs
AlmaLinux:8
From an advisory covering 13 CVEs
 before 1:24.22.1-1.module_el8.10.0+4331+0683c9c1
1:24.22.1-1.module_el8.10.0+4331+0683c9c1
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 13 CVEs
 before 1:24.22.1-1.module_el8.10.0+4331+0683c9c1
1:24.22.1-1.module_el8.10.0+4331+0683c9c1
nodejs-libs
AlmaLinux:8
From an advisory covering 13 CVEs
 before 1:24.22.1-1.module_el8.10.0+4331+0683c9c1
1:24.22.1-1.module_el8.10.0+4331+0683c9c1
nodejs-nodemon
AlmaLinux:8
From an advisory covering 13 CVEs
 before 3.1.14-2.module_el8.10.0+4250+09238ed4
3.1.14-2.module_el8.10.0+4250+09238ed4
nodejs-packaging
AlmaLinux:8
From an advisory covering 13 CVEs
 before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
Show 39 moreShow less
Affected packages
PackageAffectedFixed
nodejs-packaging-bundler
AlmaLinux:8
From an advisory covering 13 CVEs
 before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
npm
AlmaLinux:8
From an advisory covering 13 CVEs
 before 1:11.19.1-1.24.22.1.1.module_el8.10.0+4331+0683c9c1
1:11.19.1-1.24.22.1.1.module_el8.10.0+4331+0683c9c1
v8-13.6-devel
AlmaLinux:8
From an advisory covering 13 CVEs
 before 3:13.6.233.17-1.24.22.1.1.module_el8.10.0+4331+0683c9c1
3:13.6.233.17-1.24.22.1.1.module_el8.10.0+4331+0683c9c1
nodejs
AlmaLinux:9
From an advisory covering 13 CVEs
 before 1:24.22.1-3.module_el9.8.0+333+788f3075
1:24.22.1-3.module_el9.8.0+333+788f3075
nodejs-devel
AlmaLinux:9
From an advisory covering 13 CVEs
 before 1:24.22.1-3.module_el9.8.0+333+788f3075
1:24.22.1-3.module_el9.8.0+333+788f3075
nodejs-docs
AlmaLinux:9
From an advisory covering 13 CVEs
 before 1:24.22.1-3.module_el9.8.0+333+788f3075
1:24.22.1-3.module_el9.8.0+333+788f3075
nodejs-full-i18n
AlmaLinux:9
From an advisory covering 13 CVEs
 before 1:24.22.1-3.module_el9.8.0+333+788f3075
1:24.22.1-3.module_el9.8.0+333+788f3075
nodejs-libs
AlmaLinux:9
From an advisory covering 13 CVEs
 before 1:24.22.1-3.module_el9.8.0+333+788f3075
1:24.22.1-3.module_el9.8.0+333+788f3075
nodejs-nodemon
AlmaLinux:9
From an advisory covering 13 CVEs
 before 3.1.14-3.module_el9.8.0+292+f4eaf8b2
3.1.14-3.module_el9.8.0+292+f4eaf8b2
nodejs-packaging
AlmaLinux:9
From an advisory covering 13 CVEs
 before 2021.06-6.module_el9.7.0+209+ecf6523e
2021.06-6.module_el9.7.0+209+ecf6523e
nodejs-packaging-bundler
AlmaLinux:9
From an advisory covering 13 CVEs
 before 2021.06-6.module_el9.7.0+209+ecf6523e
2021.06-6.module_el9.7.0+209+ecf6523e
npm
AlmaLinux:9
From an advisory covering 13 CVEs
 before 1:11.19.1-1.24.22.1.3.module_el9.8.0+333+788f3075
1:11.19.1-1.24.22.1.3.module_el9.8.0+333+788f3075
v8-13.6-devel
AlmaLinux:9
From an advisory covering 13 CVEs
 before 3:13.6.233.17-1.24.22.1.3.module_el9.8.0+333+788f3075
3:13.6.233.17-1.24.22.1.3.module_el9.8.0+333+788f3075
nodejs
Azure Linux:3
 before 24.22.1-0
24.22.1-0
nodejs26
Alpaquita:25
 26.7.0-r0 up to 26.12.1-r0
26.12.1-r0
nodejs26
Alpaquita:stream
 26.7.0-r0 up to 26.12.1-r1
26.12.1-r1
nodejs26
BellSoft Hardened Containers:25
 26.7.0-r0 up to 26.12.1-r0
26.12.1-r0
nodejs26
BellSoft Hardened Containers:stream
 26.7.0-r0 up to 26.12.1-r1
26.12.1-r1
node
Bitnami
 25.0.0 up to 26.12.1
26.12.1
node-min
Bitnami
 25.0.0 up to 26.12.1
26.12.1
nodejs-nodemon
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:3.1.14-2.module+el8.10.0+40277+b1b3f89e
0:3.1.14-2.module+el8.10.0+40277+b1b3f89e
nodejs-nodemon
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:3.1.14-2.module+el8.10.0+40278+50b003a3
0:3.1.14-2.module+el8.10.0+40278+50b003a3
nodejs-packaging
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:2021.06-6.module+el8.10.0+40048+6d99f608
0:2021.06-6.module+el8.10.0+40048+6d99f608
nodejs-packaging
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:2021.06-6.module+el8.10.0+40171+8fa9c325
0:2021.06-6.module+el8.10.0+40171+8fa9c325
nodejs-packaging
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:2021.06-6.module+el8.10.0+40172+38f6fdd1
0:2021.06-6.module+el8.10.0+40172+38f6fdd1
nodejs
Rocky Linux:9
From an advisory covering 13 CVEs
 before 1:24.22.1-3.module+el9.8.0+40401+e24b8c95
1:24.22.1-3.module+el9.8.0+40401+e24b8c95
nodejs-nodemon
Rocky Linux:9
From an advisory covering 13 CVEs
 before 0:3.1.14-3.module+el9.8.0+40281+14cc6568
0:3.1.14-3.module+el9.8.0+40281+14cc6568
nodejs-packaging
Rocky Linux:9
From an advisory covering 13 CVEs
 before 0:2021.06-6.module+el9.7.0+40165+d075e3f2
0:2021.06-6.module+el9.7.0+40165+d075e3f2
nodejs-packaging
Rocky Linux:9
From an advisory covering 13 CVEs
 before 0:2021.06-6.module+el9.8.0+40164+8921ab53
0:2021.06-6.module+el9.8.0+40164+8921ab53
nodejs-packaging
Rocky Linux:9
From an advisory covering 13 CVEs
 before 0:2021.06-6.module+el9.7.0+40052+e32ea525
0:2021.06-6.module+el9.7.0+40052+e32ea525
nodejs-packaging
Rocky Linux:9
From an advisory covering 13 CVEs
 before 0:2021.06-6.module+el9.7.0+40153+4d595597
0:2021.06-6.module+el9.7.0+40153+4d595597
nodejs
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
0.10.15~dfsg1-40.10.21~dfsg1-10.10.22~dfsg1-20.10.23~dfsg1-10.10.23~dfsg1-2
Show 7 moreShow less
0.10.23~dfsg1-30.10.24~dfsg1-10.10.25~dfsg2-20.10.25~dfsg2-2ubuntu10.10.25~dfsg2-2ubuntu1.20.10.25~dfsg2-2ubuntu1.2+esm10.10.25~dfsg2-2ubuntu1.2+esm2
 None known
nodejs
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.10.25~dfsg2-2ubuntu14.2.2~dfsg-14.2.3~dfsg-14.2.4~dfsg-1ubuntu14.2.4~dfsg-2
Show 7 moreShow less
4.2.6~dfsg-1ubuntu14.2.6~dfsg-1ubuntu44.2.6~dfsg-1ubuntu4.14.2.6~dfsg-1ubuntu4.24.2.6~dfsg-1ubuntu4.2+esm14.2.6~dfsg-1ubuntu4.2+esm24.2.6~dfsg-1ubuntu4.2+esm3
 None known
nodejs
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
6.11.4~dfsg-1ubuntu16.11.4~dfsg-1ubuntu26.12.0~dfsg-1ubuntu16.12.0~dfsg-2ubuntu16.12.0~dfsg-2ubuntu2
Show 10 moreShow less
8.10.0~dfsg-28.10.0~dfsg-2ubuntu0.28.10.0~dfsg-2ubuntu0.38.10.0~dfsg-2ubuntu0.48.10.0~dfsg-2ubuntu0.4+esm18.10.0~dfsg-2ubuntu0.4+esm28.10.0~dfsg-2ubuntu0.4+esm38.10.0~dfsg-2ubuntu0.4+esm48.10.0~dfsg-2ubuntu0.4+esm58.10.0~dfsg-2ubuntu0.4+esm6
 None known
nodejs
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
10.15.2~dfsg-2ubuntu110.17.0~dfsg-2ubuntu410.17.0~dfsg-2ubuntu610.19.0~dfsg-3ubuntu110.19.0~dfsg-3ubuntu1.1
Show 5 moreShow less
10.19.0~dfsg-3ubuntu1.210.19.0~dfsg-3ubuntu1.310.19.0~dfsg-3ubuntu1.510.19.0~dfsg-3ubuntu1.610.19.0~dfsg-3ubuntu1.6+esm2
 None known
nodejs
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
12.22.5~dfsg-5ubuntu112.22.7~dfsg-2ubuntu112.22.7~dfsg-2ubuntu312.22.9~dfsg-1ubuntu212.22.9~dfsg-1ubuntu3
Show 7 moreShow less
12.22.9~dfsg-1ubuntu3.112.22.9~dfsg-1ubuntu3.212.22.9~dfsg-1ubuntu3.312.22.9~dfsg-1ubuntu3.412.22.9~dfsg-1ubuntu3.512.22.9~dfsg-1ubuntu3.612.22.9~dfsg-1ubuntu3.6+esm2
 None known
nodejs
Ubuntu:24.04:LTS
 All versions, plus listed versions
18.13.0+dfsg1-1ubuntu218.19.1+dfsg-2ubuntu418.19.1+dfsg-6ubuntu118.19.1+dfsg-6ubuntu218.19.1+dfsg-6ubuntu5
 None known
nodejs
Ubuntu:26.10
 All versions, plus listed versions
22.22.1+dfsg+~cs22.19.15-1ubuntu124.16.0+dfsg+~cs24.13.1-2ubuntu124.18.0+dfsg+~cs24.13.2-1ubuntu124.19.0+dfsg+~cs24.13.3-1ubuntu1
 None known
nodejs
Ubuntu:26.04:LTS
 All versions, plus listed versions
20.19.4+dfsg-120.19.5+dfsg+~cs20.19.12-422.21.1+dfsg+~cs22.19.0-6ubuntu422.22.0+dfsg+~cs22.19.6-1ubuntu222.22.0+dfsg+~cs22.19.13-2ubuntu122.22.1+dfsg+~cs22.19.15-1ubuntu1
 None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubCompleteTech-Security/node-cve-2026-106071-check2026-10-23

History

History
RecordedChangedSources
affected
factsOSV
affectedEUVD, OSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-106071 is a low vulnerability (CVSS 3.6) in Nodejs Node, published October 23, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 9th percentile. Fixed in nodejs 24.22.1-r0.

References

Show 46 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open