{"id":"CVE-2026-106071","aliases":["ALPINE-CVE-2026-106071","ALSA-2026:92376","ALSA-2026:92378","AZL-111023","BELL-CVE-2026-106071","BIT-node-2026-106071","BIT-node-min-2026-106071","DEBIAN-CVE-2026-106071","EUVD-2026-109103","GHSA-jjjg-m7c2-q32j","RLSA-2026:92376","RLSA-2026:92378","UBUNTU-CVE-2026-106071"],"status":"published","title":"A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not...","description":"A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule.\n\nWhen the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, `--allow-fs-read=/etc/passwd.*` also allows reading `/etc/passwd`. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043.\n\nThis vulnerability affects Node.js **26.x**.","severity":{"version":"3.0","score":3.6,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N/CR:M/IR:M/AR:M","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00199,"percentile":0.09893,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-284"],"published":"2026-10-23T16:15:05Z","modified":"2026-11-12T07:00:08Z","exploits":[{"source":"pocgithub","id":"CompleteTech-Security/node-cve-2026-106071-check","title":"CompleteTech-Security/node-cve-2026-106071-check","date":"2026-10-23","url":"https://github.com/CompleteTech-Security/node-cve-2026-106071-check"}],"fixes":[{"ecosystem":"Alpine:v3.23","package":"nodejs","fixed_in":["24.22.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nodejs","fixed_in":["24.22.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nodejs-current","fixed_in":["26.12.1-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"nodejs","fixed_in":["24.22.1-0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"nodejs26","fixed_in":["26.12.1-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"nodejs26","fixed_in":["26.12.1-r1"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"nodejs26","fixed_in":["26.12.1-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"nodejs26","fixed_in":["26.12.1-r1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node","fixed_in":["26.12.1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node-min","fixed_in":["26.12.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.22.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.22.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.12.1-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-1.module_el8.10.0+4331+0683c9c1"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-1.module_el8.10.0+4331+0683c9c1"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-1.module_el8.10.0+4331+0683c9c1"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-1.module_el8.10.0+4331+0683c9c1"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-1.module_el8.10.0+4331+0683c9c1"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.14-2.module_el8.10.0+4250+09238ed4"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el8.10.0+4086+70facd4a"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el8.10.0+4086+70facd4a"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.19.1-1.24.22.1.1.module_el8.10.0+4331+0683c9c1"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.22.1.1.module_el8.10.0+4331+0683c9c1"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.module_el9.8.0+333+788f3075"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.module_el9.8.0+333+788f3075"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.module_el9.8.0+333+788f3075"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.module_el9.8.0+333+788f3075"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.module_el9.8.0+333+788f3075"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.14-3.module_el9.8.0+292+f4eaf8b2"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+209+ecf6523e"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+209+ecf6523e"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.19.1-1.24.22.1.3.module_el9.8.0+333+788f3075"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.22.1.3.module_el9.8.0+333+788f3075"}]}],"bundled":13},{"source":"osv","ecosystem":"Azure Linux:3","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.22.1-0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"nodejs26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"26.7.0-r0"},{"fixed":"26.12.1-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"nodejs26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"26.7.0-r0"},{"fixed":"26.12.1-r1"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"nodejs26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"26.7.0-r0"},{"fixed":"26.12.1-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"nodejs26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"26.7.0-r0"},{"fixed":"26.12.1-r1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node","ranges":[{"type":"SEMVER","events":[{"introduced":"25.0.0"},{"fixed":"26.12.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node-min","ranges":[{"type":"SEMVER","events":[{"introduced":"25.0.0"},{"fixed":"26.12.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["18.13.0+dfsg1-1","18.13.0+dfsg1-1.1","18.19.0+dfsg-1","18.19.0+dfsg-2","18.19.0+dfsg-3","18.19.0+dfsg-4","18.19.0+dfsg-5","18.19.0+dfsg-6","18.19.0+dfsg-6~deb12u1","18.19.0+dfsg-6~deb12u2","18.19.1+dfsg-1","18.19.1+dfsg-2","18.19.1+dfsg-3","18.19.1+dfsg-3.1","18.19.1+dfsg-4","18.19.1+dfsg-6","18.20.1+dfsg-1","18.20.1+dfsg-2","18.20.1+dfsg-3","18.20.1+dfsg-4","18.20.4+dfsg-1~deb12u1","18.20.4+dfsg-1~deb12u2","18.20.4+dfsg-1~deb12u3","20.10.0+dfsg-1","20.12.2+dfsg-1","20.13.0+dfsg-1","20.13.1+dfsg-1","20.13.1+dfsg-2","20.14.0+dfsg-1","20.14.0+dfsg-2","20.14.0+dfsg-3","20.15.0+dfsg-1","20.15.1+dfsg-1","20.16.0+dfsg-1","20.17.0+dfsg-1","20.17.0+dfsg-2","20.18.0+dfsg-1","20.18.0+dfsg-2","20.18.1+dfsg-1","20.18.1+dfsg-2","20.18.2+dfsg-1","20.18.2+dfsg-2","20.18.2+dfsg-3","20.18.2+dfsg-4","20.18.3+dfsg-1","20.19.0+dfsg-1","20.19.0+dfsg-2","20.19.0+dfsg1-1","20.19.2+dfsg-1","20.19.4+dfsg-1","20.19.5+dfsg+~cs20.19.12-1","20.19.5+dfsg+~cs20.19.12-2","20.19.5+dfsg+~cs20.19.12-3","20.19.5+dfsg+~cs20.19.12-4","20.19.5+dfsg+~cs20.19.24-1","22.12.0+dfsg-1","22.12.0+dfsg-2","22.12.0+dfsg-3","22.14.0+dfsg-1","22.18.0+dfsg+~cs22.17.2-1","22.18.0+dfsg+~cs22.17.2-2","22.18.0+dfsg-1","22.19.0+dfsg+~cs22.18.0-1","22.21.1+dfsg+~cs22.19.0-1","22.21.1+dfsg+~cs22.19.0-2","22.21.1+dfsg+~cs22.19.0-3","22.21.1+dfsg+~cs22.19.0-4","22.21.1+dfsg+~cs22.19.0-5","22.21.1+dfsg+~cs22.19.0-6","22.22.0+dfsg+~cs22.19.13-1","22.22.0+dfsg+~cs22.19.13-2","22.22.0+dfsg+~cs22.19.6-1","22.22.1+dfsg+~cs22.19.15-1","22.22.2+dfsg+~cs22.19.15-1","22.22.2+dfsg+~cs22.19.15-3","24.11.1+dfsg+~cs24.10.1-1","24.11.1+dfsg+~cs24.10.1-2","24.12.0+dfsg+~cs24.10.4-1","24.13.0+dfsg+~cs24.10.7-1","24.13.0+dfsg+~cs24.10.7-2","24.14.0+dfsg+~cs24.12.0-1","24.14.0+dfsg+~cs24.12.0-2","24.14.1+dfsg+~cs24.12.0-1","24.15.0+dfsg+~cs24.12.2-1","24.16.0+dfsg+~cs24.13.1-1","24.16.0+dfsg+~cs24.13.1-2","24.17.0+dfsg+~cs24.13.2-1","24.18.0+dfsg+~cs24.13.2-1","24.19.0+dfsg+~cs24.13.3-1","24.20.0+dfsg+~cs24.13.3-1","24.20.0+dfsg+~cs24.13.3-2","24.21.0+dfsg+~cs24.13.4-1","24.22.0+dfsg+~cs24.19.2-1","24.22.0+dfsg+~cs24.19.2-2","24.22.1+dfsg+~cs24.19.2-1","24.22.2+dfsg+~cs24.19.2-1"]},{"source":"osv","ecosystem":"Debian:13","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20.19.2+dfsg-1","20.19.2+dfsg-1+deb13u1","20.19.2+dfsg-1+deb13u2","20.19.2+dfsg-1+deb13u3","20.19.4+dfsg-1","20.19.5+dfsg+~cs20.19.12-1","20.19.5+dfsg+~cs20.19.12-2","20.19.5+dfsg+~cs20.19.12-3","20.19.5+dfsg+~cs20.19.12-4","20.19.5+dfsg+~cs20.19.24-1","22.12.0+dfsg-1","22.12.0+dfsg-2","22.12.0+dfsg-3","22.14.0+dfsg-1","22.18.0+dfsg+~cs22.17.2-1","22.18.0+dfsg+~cs22.17.2-2","22.18.0+dfsg-1","22.19.0+dfsg+~cs22.18.0-1","22.21.1+dfsg+~cs22.19.0-1","22.21.1+dfsg+~cs22.19.0-2","22.21.1+dfsg+~cs22.19.0-3","22.21.1+dfsg+~cs22.19.0-4","22.21.1+dfsg+~cs22.19.0-5","22.21.1+dfsg+~cs22.19.0-6","22.22.0+dfsg+~cs22.19.13-1","22.22.0+dfsg+~cs22.19.13-2","22.22.0+dfsg+~cs22.19.6-1","22.22.1+dfsg+~cs22.19.15-1","22.22.2+dfsg+~cs22.19.15-1","22.22.2+dfsg+~cs22.19.15-3","24.11.1+dfsg+~cs24.10.1-1","24.11.1+dfsg+~cs24.10.1-2","24.12.0+dfsg+~cs24.10.4-1","24.13.0+dfsg+~cs24.10.7-1","24.13.0+dfsg+~cs24.10.7-2","24.14.0+dfsg+~cs24.12.0-1","24.14.0+dfsg+~cs24.12.0-2","24.14.1+dfsg+~cs24.12.0-1","24.15.0+dfsg+~cs24.12.2-1","24.16.0+dfsg+~cs24.13.1-1","24.16.0+dfsg+~cs24.13.1-2","24.17.0+dfsg+~cs24.13.2-1","24.18.0+dfsg+~cs24.13.2-1","24.19.0+dfsg+~cs24.13.3-1","24.20.0+dfsg+~cs24.13.3-1","24.20.0+dfsg+~cs24.13.3-2","24.21.0+dfsg+~cs24.13.4-1","24.22.0+dfsg+~cs24.19.2-1","24.22.0+dfsg+~cs24.19.2-2","24.22.1+dfsg+~cs24.19.2-1","24.22.2+dfsg+~cs24.19.2-1"]},{"source":"osv","ecosystem":"Debian:14","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20.19.2+dfsg-1","20.19.4+dfsg-1","20.19.5+dfsg+~cs20.19.12-1","20.19.5+dfsg+~cs20.19.12-2","20.19.5+dfsg+~cs20.19.12-3","20.19.5+dfsg+~cs20.19.12-4","20.19.5+dfsg+~cs20.19.24-1","22.12.0+dfsg-1","22.12.0+dfsg-2","22.12.0+dfsg-3","22.14.0+dfsg-1","22.18.0+dfsg+~cs22.17.2-1","22.18.0+dfsg+~cs22.17.2-2","22.18.0+dfsg-1","22.19.0+dfsg+~cs22.18.0-1","22.21.1+dfsg+~cs22.19.0-1","22.21.1+dfsg+~cs22.19.0-2","22.21.1+dfsg+~cs22.19.0-3","22.21.1+dfsg+~cs22.19.0-4","22.21.1+dfsg+~cs22.19.0-5","22.21.1+dfsg+~cs22.19.0-6","22.22.0+dfsg+~cs22.19.13-1","22.22.0+dfsg+~cs22.19.13-2","22.22.0+dfsg+~cs22.19.6-1","22.22.1+dfsg+~cs22.19.15-1","22.22.2+dfsg+~cs22.19.15-1","22.22.2+dfsg+~cs22.19.15-3","24.11.1+dfsg+~cs24.10.1-1","24.11.1+dfsg+~cs24.10.1-2","24.12.0+dfsg+~cs24.10.4-1","24.13.0+dfsg+~cs24.10.7-1","24.13.0+dfsg+~cs24.10.7-2","24.14.0+dfsg+~cs24.12.0-1","24.14.0+dfsg+~cs24.12.0-2","24.14.1+dfsg+~cs24.12.0-1","24.15.0+dfsg+~cs24.12.2-1","24.16.0+dfsg+~cs24.13.1-1","24.16.0+dfsg+~cs24.13.1-2","24.17.0+dfsg+~cs24.13.2-1","24.18.0+dfsg+~cs24.13.2-1","24.19.0+dfsg+~cs24.13.3-1","24.20.0+dfsg+~cs24.13.3-1","24.20.0+dfsg+~cs24.13.3-2","24.21.0+dfsg+~cs24.13.4-1","24.22.0+dfsg+~cs24.19.2-1","24.22.0+dfsg+~cs24.19.2-2","24.22.1+dfsg+~cs24.19.2-1","24.22.2+dfsg+~cs24.19.2-1"]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el8.10.0+40277+b1b3f89e"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el8.10.0+40278+50b003a3"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40048+6d99f608"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40171+8fa9c325"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40172+38f6fdd1"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.module+el9.8.0+40401+e24b8c95"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-3.module+el9.8.0+40281+14cc6568"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40165+d075e3f2"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.8.0+40164+8921ab53"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40052+e32ea525"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40153+4d595597"}]}],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.15~dfsg1-4","0.10.21~dfsg1-1","0.10.22~dfsg1-2","0.10.23~dfsg1-1","0.10.23~dfsg1-2","0.10.23~dfsg1-3","0.10.24~dfsg1-1","0.10.25~dfsg2-2","0.10.25~dfsg2-2ubuntu1","0.10.25~dfsg2-2ubuntu1.2","0.10.25~dfsg2-2ubuntu1.2+esm1","0.10.25~dfsg2-2ubuntu1.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.25~dfsg2-2ubuntu1","4.2.2~dfsg-1","4.2.3~dfsg-1","4.2.4~dfsg-1ubuntu1","4.2.4~dfsg-2","4.2.6~dfsg-1ubuntu1","4.2.6~dfsg-1ubuntu4","4.2.6~dfsg-1ubuntu4.1","4.2.6~dfsg-1ubuntu4.2","4.2.6~dfsg-1ubuntu4.2+esm1","4.2.6~dfsg-1ubuntu4.2+esm2","4.2.6~dfsg-1ubuntu4.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.4~dfsg-1ubuntu1","6.11.4~dfsg-1ubuntu2","6.12.0~dfsg-1ubuntu1","6.12.0~dfsg-2ubuntu1","6.12.0~dfsg-2ubuntu2","8.10.0~dfsg-2","8.10.0~dfsg-2ubuntu0.2","8.10.0~dfsg-2ubuntu0.3","8.10.0~dfsg-2ubuntu0.4","8.10.0~dfsg-2ubuntu0.4+esm1","8.10.0~dfsg-2ubuntu0.4+esm2","8.10.0~dfsg-2ubuntu0.4+esm3","8.10.0~dfsg-2ubuntu0.4+esm4","8.10.0~dfsg-2ubuntu0.4+esm5","8.10.0~dfsg-2ubuntu0.4+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.15.2~dfsg-2ubuntu1","10.17.0~dfsg-2ubuntu4","10.17.0~dfsg-2ubuntu6","10.19.0~dfsg-3ubuntu1","10.19.0~dfsg-3ubuntu1.1","10.19.0~dfsg-3ubuntu1.2","10.19.0~dfsg-3ubuntu1.3","10.19.0~dfsg-3ubuntu1.5","10.19.0~dfsg-3ubuntu1.6","10.19.0~dfsg-3ubuntu1.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.22.5~dfsg-5ubuntu1","12.22.7~dfsg-2ubuntu1","12.22.7~dfsg-2ubuntu3","12.22.9~dfsg-1ubuntu2","12.22.9~dfsg-1ubuntu3","12.22.9~dfsg-1ubuntu3.1","12.22.9~dfsg-1ubuntu3.2","12.22.9~dfsg-1ubuntu3.3","12.22.9~dfsg-1ubuntu3.4","12.22.9~dfsg-1ubuntu3.5","12.22.9~dfsg-1ubuntu3.6","12.22.9~dfsg-1ubuntu3.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["18.13.0+dfsg1-1ubuntu2","18.19.1+dfsg-2ubuntu4","18.19.1+dfsg-6ubuntu1","18.19.1+dfsg-6ubuntu2","18.19.1+dfsg-6ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["22.22.1+dfsg+~cs22.19.15-1ubuntu1","24.16.0+dfsg+~cs24.13.1-2ubuntu1","24.18.0+dfsg+~cs24.13.2-1ubuntu1","24.19.0+dfsg+~cs24.13.3-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20.19.4+dfsg-1","20.19.5+dfsg+~cs20.19.12-4","22.21.1+dfsg+~cs22.19.0-6ubuntu4","22.22.0+dfsg+~cs22.19.6-1ubuntu2","22.22.0+dfsg+~cs22.19.13-2ubuntu1","22.22.1+dfsg+~cs22.19.15-1ubuntu1"]}],"products":[{"vendor":"nodejs","product":"node"}],"references":[{"url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106071","tags":["web"]},{"url":"https://github.com/advisories/GHSA-jjjg-m7c2-q32j"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-106071","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:92376","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-101911","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-102276","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-102277","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-102278","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-105481","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-105482","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-105483","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106069","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106071","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106072","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106073","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106074","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-111497","tags":["report"]},{"url":"https://bugzilla.redhat.com/2542596","tags":["report"]},{"url":"https://bugzilla.redhat.com/2542700","tags":["report"]},{"url":"https://bugzilla.redhat.com/2542706","tags":["report"]},{"url":"https://bugzilla.redhat.com/2542707","tags":["report"]},{"url":"https://bugzilla.redhat.com/2558973","tags":["report"]},{"url":"https://bugzilla.redhat.com/2559870","tags":["report"]},{"url":"https://bugzilla.redhat.com/2559873","tags":["report"]},{"url":"https://bugzilla.redhat.com/2559875","tags":["report"]},{"url":"https://bugzilla.redhat.com/2560016","tags":["report"]},{"url":"https://bugzilla.redhat.com/2560018","tags":["report"]},{"url":"https://bugzilla.redhat.com/2560019","tags":["report"]},{"url":"https://bugzilla.redhat.com/2560021","tags":["report"]},{"url":"https://bugzilla.redhat.com/2560022","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-92376.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:92378","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-92378.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-106071","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-106071","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:92376","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542596","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542700","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542706","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542707","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2558973","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2559870","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2559873","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2559875","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560016","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560018","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560021","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560022","tags":["report"]},{"url":"https://errata.rockylinux.org/RLSA-2026:92378","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-106071","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-106071","tags":["report"]},{"url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#permission-model-filesystem-over-grant-via-wildcard-radix-lookup-cve-2026-106071---low","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-106071","description":"A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule.\n\nWhen the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, `--allow-fs-read=/etc/passwd.*` also allows reading `/etc/passwd`. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043.\n\nThis vulnerability affects Node.js **26.x**.","status":"published","published":"2026-10-23T16:15:05.791Z","modified":"2026-11-02T15:40:27.184Z","cvss":[{"version":"3.0","score":3.6,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N/CR:M/IR:M/AR:M","level":"low","assessor":"cna"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T18:00:08.034842Z"}],"euvd":[{"id":"EUVD-2026-109103","description":"A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule.\n\nWhen the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, `--allow-fs-read=/etc/passwd.*` also allows reading `/etc/passwd`. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043.\n\nThis vulnerability affects Node.js **26.x**.","status":"published","published":"2026-10-23T16:15:05Z","modified":"2026-11-02T15:40:27Z","cvss":[{"version":"3.0","score":3.6,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N/CR:M/IR:M/AR:M","level":"low"}],"updated_at":"2026-11-03T05:08:40.757493Z"}],"ghsa":[{"id":"GHSA-jjjg-m7c2-q32j","title":"A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not...","description":"A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule.\n\nWhen the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, `--allow-fs-read=/etc/passwd.*` also allows reading `/etc/passwd`. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043.\n\nThis vulnerability affects Node.js **26.x**.","status":"published","published":"2026-10-23T18:31:39Z","modified":"2026-10-23T18:31:39Z","cvss":[{"version":"3.0","score":3.6,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:14:20.113334Z"}],"nvd":[{"id":"CVE-2026-106071","description":"A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule.\n\nWhen the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, `--allow-fs-read=/etc/passwd.*` also allows reading `/etc/passwd`. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043.\n\nThis vulnerability affects Node.js **26.x**.","status":"published","published":"2026-10-23T17:17:20.06Z","modified":"2026-11-02T16:17:25.067Z","cvss":[{"version":"3.0","score":3.6,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T20:51:42.579129Z"}],"osv":[{"id":"ALPINE-CVE-2026-106071","description":"A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule.\n\nWhen the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, `--allow-fs-read=/etc/passwd.*` also allows reading `/etc/passwd`. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043.\n\nThis vulnerability affects Node.js **26.x**.","status":"published","published":"2026-10-23T17:17:20.06Z","modified":"2026-11-03T06:32:52.414441745Z","cvss":[{"version":"3.0","score":3.6,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-03T07:16:26.770911Z"},{"id":"BELL-CVE-2026-106071","status":"published","published":"2026-10-24T06:08:18.609166Z","modified":"2026-11-01T07:15:03.912960455Z","cvss":[{"version":"3.0","score":3.6,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:28:23.037038Z"},{"id":"DEBIAN-CVE-2026-106071","description":"A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule.  When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, `--allow-fs-read=/etc/passwd.*` also allows reading `/etc/passwd`. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043.  This vulnerability affects Node.js **26.x**.","status":"published","published":"2026-10-23T17:17:20.06Z","modified":"2026-11-12T07:00:08.505438672Z","cvss":[{"version":"3.0","score":3.6,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-12T07:34:39.962272Z"},{"id":"RLSA-2026:92376","title":"Important: nodejs:24 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)\n\n* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n\n* brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)\n\n* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n\n* brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)\n\n* nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)\n\n* nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n\n* nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\n* nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)\n\n* nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)\n\n* nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)\n\n* nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)\n\n* nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)\n\nBug Fix(es) and Enhancement(s):\n\n* nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:Rocky Linux-289763)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-30T00:01:28.043412Z","modified":"2026-10-30T00:30:02.808138726Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:92378","title":"Important: nodejs:24 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)\n\n* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n\n* brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)\n\n* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n\n* brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)\n\n* nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)\n\n* nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n\n* nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\n* nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)\n\n* nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)\n\n* nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)\n\n* nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)\n\n* nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)\n\nBug Fix(es) and Enhancement(s):\n\n* nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:Rocky Linux-293233)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-30T12:04:27.805649Z","modified":"2026-10-30T12:30:02.317716363Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"UBUNTU-CVE-2026-106071","description":"A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, `--allow-fs-read=/etc/passwd.*` also allows reading `/etc/passwd`. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043. This vulnerability affects Node.js **26.x**.","status":"published","published":"2026-10-23T17:17:00Z","modified":"2026-10-28T20:17:40.878240689Z","cvss":[{"version":"3.0","score":3.6,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T16:55:59.130573Z"},{"id":"ALSA-2026:92376","title":"Important: nodejs:24 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)\n  * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n  * brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)\n  * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n  * brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)\n  * nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)\n  * nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n  * nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n  * nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)\n  * nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)\n  * nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)\n  * nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)\n  * nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:RHEL-289763)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-29T00:00:00Z","modified":"2026-10-29T22:30:02.511793774Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:92378","title":"Important: nodejs:24 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)\n  * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n  * brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)\n  * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n  * brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)\n  * nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)\n  * nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n  * nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n  * nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)\n  * nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)\n  * nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)\n  * nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)\n  * nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:RHEL-293233)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-29T00:00:00Z","modified":"2026-10-29T22:45:02.311915713Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"AZL-111023","title":"CVE-2026-106071 affecting package nodejs for versions less than 24.22.1-0","description":"A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule.\n\nWhen the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, `--allow-fs-read=/etc/passwd.*` also allows reading `/etc/passwd`. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043.\n\nThis vulnerability affects Node.js **26.x**.","status":"published","published":"2026-10-23T17:17:20Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"BIT-node-2026-106071","description":"A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule.\n\nWhen the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, `--allow-fs-read=/etc/passwd.*` also allows reading `/etc/passwd`. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043.\n\nThis vulnerability affects Node.js **26.x**.","status":"published","published":"2026-10-29T08:55:59.241Z","modified":"2026-10-29T10:56:09.995695626Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"BIT-node-min-2026-106071","description":"A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule.\n\nWhen the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, `--allow-fs-read=/etc/passwd.*` also allows reading `/etc/passwd`. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043.\n\nThis vulnerability affects Node.js **26.x**.","status":"published","published":"2026-10-29T08:56:12.684Z","modified":"2026-10-29T10:56:09.995695626Z","updated_at":"2026-11-02T15:28:34.007508Z"}]}}