CVE-2026-58043

score

0.1

cvss

8.4

epss

0.2%

published

2026-07-30

kev added

—

first seen

2026-10-21

Node.js main, 22.x, 24.x, and 26.x contain a broken access control vulnerability caused by improper enforcement of filesystem permission model across radix-tree prefix boundaries, letting attackers with granted path access read or write outside intended allowlist, exploit requires attacker to have filesystem permission on one path.