CVE Feed

    Dashboard / CVE / CVE-2026-58039

    CVE-2026-58039

    A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.

    Published:Jul 31, 2026
    Last Modified:Aug 3, 2026
    EPS:Jul 31, 2026
    EPSS Score:0.00169
    CVSS Score:3.3

    Affected Products

    Vendor
    Nodejs
    Product
    Nodejs

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-284 Improper Access Control

    Related CVEs

    CVE-2026-48932 (CVSS 3.7) — A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that …
    CVE-2026-56848 (CVSS 7.5) — A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2…
    CVE-2026-58042 (CVSS 5.9) — A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than…
    CVE-2026-58044 (CVSS 3.7) — A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that …
    CVE-2026-58045 (CVSS 6.2) — A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchrono…
    CVE-2026-58041 (CVSS 5.3) — A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore…
    CVE-2026-56846 (CVSS 7.5) — A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable re…
    CVE-2026-56847 (CVSS 6.1) — A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Log…
    CVE-2026-56850 (CVSS 4.4) — A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS …
    CVE-2026-58043 (CVSS 8.4) — A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix bound…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High