CVE-2026-58043 is a high-severity security vulnerability affecting certain Node.js deployments that use the Permission Model to restrict filesystem access. If your organization relies on Node.js applications, internal tools, APIs, or cloud services, you may be exposed when an application grants limited access to files or directories but runs on a vulnerable release.
The issue matters because a security control intended to limit what application code can read or change may not enforce those limits reliably. That could increase the impact of a separate compromise, malicious package, insider action, or vulnerable application component.
This article explains the business implications of CVE-2026-58043, how to determine whether your organization is affected, and what steps you should take. A technical appendix provides detection, verification, mitigation, and remediation guidance for security engineers, penetration testers, and IT professionals.
CVE-2026-58043 was publicly disclosed on July 30, 2026, following a Node.js security release published July 29. The vulnerability affects the Node.js Permission Model, an optional security feature enabled with the --permission flag. It was reported by security researcher sy2n0 through HackerOne, with RafaelGSS credited for the fix.a
The affected release lines include Node.js 22.x, 24.x, and 26.x. Node.js also identifies end-of-life release lines as affected when a security release addresses the same product area, so organizations operating Node.js 20 or other unsupported versions should not assume they are safe.
The weakness is improper access control, meaning the software may grant more filesystem access than administrators intended. NVD lists CWE-284, Improper Access Control, and records the vulnerability as published by HackerOne.
The published CVSS version 3.1 score is 7.5, classified as high. The vector indicates local access, high attack complexity, low privileges, no user interaction, changed scope, and high potential impact to confidentiality and integrity.
If you use Node.js with the Permission Model, CVE-2026-58043 could weaken an important boundary between application code and sensitive files. An attacker who already has limited access to a Node.js process may be able to read information or modify files outside the directories approved by your security configuration.
For your operations, that could expose application configuration, credentials, source code, customer records, private keys, logs, or locally stored business data. Modification of files could affect application behavior, alter deployment artifacts, tamper with reports, or damage data used by business processes.
The vulnerability does not mean every Node.js application can be attacked remotely without conditions. Exploitation generally depends on an attacker first obtaining some level of access to the affected process or host. However, that initial access can come from a compromised dependency, an exploited web application, stolen credentials, a malicious insider, or another weakness in the environment.
You may also face regulatory and contractual consequences. A data exposure could trigger breach assessment and notification obligations under state, provincial, federal, or industry-specific requirements. US organizations may need to evaluate obligations under laws such as state privacy statutes, sector regulations, or contractual security clauses. Canadian organizations may need to consider federal or provincial privacy requirements. Even when no reportable breach occurs, customers and partners may question whether the organization’s security controls functioned as represented.
Regional Bank: A customer-facing Node.js service uses the Permission Model to allow access only to application files and a limited upload directory. After another application flaw gives an attacker low-privilege process access, the attacker abuses the path handling issue to access configuration files containing database credentials. The bank may face investigation, service disruption, customer notification, and increased scrutiny from regulators and business partners.
Healthcare Provider: A mid-sized healthcare organization runs a Node.js scheduling application with locally cached records and service credentials. An attacker who compromises a third-party package gains access to the application process and reads files outside the intended allowlist. Even without confirmed exfiltration, the provider may need to investigate whether protected health information was exposed and preserve evidence for compliance review.
Manufacturing Company: A factory uses a Node.js operations portal on an internal network. The service is intended to read production data but not modify deployment or automation files. Exploitation could allow an attacker to alter application files or operational settings, creating unreliable production information and potentially interrupting manufacturing workflows.
Small Software-as-a-Service Provider: A growing software company runs several tenant-facing Node.js services on shared hosts. A vulnerable Permission Model configuration may allow code in one service to reach files belonging to another service or to the host environment. The provider could experience cross-tenant exposure, loss of customer trust, incident response costs, and contractual disputes.
--permission flag and have not installed the vendor’s July 2026 security release or a later update.--permission at startup. Continue reviewing your Node.js versions because other vulnerabilities may still apply.Do not wait for an incident to reveal that a filesystem security boundary was weaker than expected. IntegSec can help you identify affected Node.js assets, validate Permission Model controls, test realistic attack paths, and reduce broader cybersecurity risk through focused penetration testing. Contact IntegSec to turn this vulnerability review into a practical, prioritized security improvement plan.
CVE-2026-58043 is an improper access control flaw in the Node.js Permission Model’s filesystem path matching. The affected implementation uses a radix-tree structure to track permitted filesystem paths. Incorrect handling of prefix boundaries can cause a permitted path to match a different path that merely shares a textual prefix, allowing access beyond the intended filesystem allowlist.
The relevant control is the Permission Model, activated with --permission and configured through options such as --allow-fs-read and --allow-fs-write. A process or code execution context with limited privileges may use the boundary-handling weakness to read or write files outside the approved paths.
The attack is local rather than directly remote, requires high attack complexity and low privileges, and does not require user interaction. The published CVSS 3.1 vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N, with a score of 7.5 and high severity.
NVD identifies CWE-284, Improper Access Control. NVD’s reference is the Node.js July 2026 security advisory, while NVD itself had not supplied a separate CVSS 4.0 assessment at the time of review.
node --version and node -p "process.versions" on hosts, containers, build agents, and service images. Review package-manager data with npm list -g --depth=0, apt-cache policy nodejs, dnf info nodejs, or the applicable platform command.--permission, --allow-fs-read, and --allow-fs-write. Examples include ps -ef | grep '[n]ode', systemctl cat service-name, and container orchestration specifications./app/data and /app/database. For systems that cannot be patched immediately, disable the Permission Model only after a documented risk review confirms that compensating controls are stronger than the vulnerable boundary. Otherwise, reduce the process’s operating-system permissions, isolate it in a dedicated container or virtual machine, remove unnecessary secrets, restrict outbound network access, mount sensitive directories read-only, and prevent access to sibling application paths. These measures reduce exposure but do not replace the vendor fix.