CVE Feed

    Dashboard / CVE / CVE-2026-106073

    CVE-2026-106073

    A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`. As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

    Published:Oct 23, 2026
    Last Modified:Oct 23, 2026
    EPS:Oct 23, 2026
    EPSS Score:
    CVSS Score:3.3

    Affected Products

    Vendor
    Nodejs
    Product
    Nodejs

    Exploits

    https://github.com/CompleTech-Security/node-cve-2026-106073-checkhttps://github.com/completetech-security/node-cve-2026-106073-checkhttps://github.com/CompleTetech-Security/node-cve-2026-106073-check

    Common Weakness Enumeration

    CWE-284 Improper Access Control

    Related CVEs

    CVE-2026-106069 (CVSS 7.4) — A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different…
    CVE-2026-105481 (CVSS 6.5) — A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent b…
    CVE-2026-105482 (CVSS 7.4) — A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.re…
    CVE-2026-106074 (CVSS 4.8) — A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUI…
    CVE-2026-106071 (CVSS 3.6) — A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildca…
    CVE-2026-106072 (CVSS 6.7) — A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP end…
    CVE-2026-105483 (CVSS 7.4) — A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenti…
    CVE-2026-106070 (CVSS 3.7) — A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entr…
    CVE-2026-111497 (CVSS 9.2) — A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through…
    CVE-2026-48932 (CVSS 3.7) — A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High