Skip to content
Node.js CVE-2026-106073: Improper Permission Model Vulnerability

Node.js CVE-2026-106073: Improper Permission Model Vulnerability

First seen 24 Oct 2026, 05:13 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 24, 2026 at 06:13 UTC
  • •CVE-2026-106073 affects Node.js versions 22.x, 24.x, and 26.x.
  • •The vulnerability allows local attackers to bypass filesystem permission checks.
  • •Patches are available in Node.js versions 22.23.4 and 24.22.1.

CVE-2026-106073 is a low-severity vulnerability affecting Node.js versions 22.x, 24.x, and 26.x. It arises from improper permission validation in the `fs.realpathSync()` function when the experimental Permission Model is enabled. This flaw allows local attackers to bypass filesystem permission restrictions, potentially accessing restricted paths. The vulnerability was disclosed on October 23, 2026, and is considered an incomplete fix of CVE-2026-21715. Patches were released in Node.js versions 22.23.4 and 24.22.1. Exploitation requires local access with low-privilege permissions and can be automated without user interaction. No proof-of-concept or has been reported as of now. Security professionals are advised to apply the vendor patches as soon as possible.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-03-30
CVE-2026-21715 published
CVE-2026-21715 was published, addressing an earlier flaw in Node.js's permission model.
Ervik.As
2026-10-23
CVE-2026-106073 published
CVE-2026-106073 was published, detailing improper permission validation in Node.js.
Ervik.As
2026-10-23
Patches released
Node.js released patches in versions 22.23.4 and 24.22.1 to address the vulnerability.
Wiz vulnerability database

More articles in this cluster (3)

Following this threat?

Track CVE-2026-106073 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (4)

1 / 3

Common questions

What versions of Node.js are affected?
Node.js versions 22.x, 24.x, and 26.x are affected by this vulnerability.
What should I do to mitigate this vulnerability?
Apply the patches released in Node.js versions 22.23.4 and 24.22.1 as soon as possible.
Is there any active exploitation of this vulnerability?
No, there have been no reports of active exploitation or proof-of-concept code for this vulnerability.