CVE-2026-106073
Fetching some sources has been requested. Reload in about a minute to see them.
CVSS v3.1 (listed by NVD)
3.3
LOW
Scored by hackerone.com (not yet scored by NVD)
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0 (listed by NVD)
—
Not scored
CVSS (listed by CVE.org)
3.3
LOW
Scored by CNA (hackerone) · v3.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS exploit probability
0.2%
Percentile 4.7%
as of 2026-10-24
CISA KEV
—
Not listed
Attack conditions and impact
Derived from the CNA (via NVD) CVSS 3.0 vector
LocalLoginNo interaction
Confidentiality LIntegrity NAvailability N
| Metric | Value | Meaning |
|---|---|---|
| Attack vector AV | L | Local |
| Attack complexity AC | L | Low (easy) |
| Privileges required PR | L | Regular user |
| User interaction UI | N | None |
| Scope S | U | Unchanged |
| Confidentiality C | L | Low |
| Integrity I | N | None |
| Availability A | N | None |
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Description
NVD
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`. As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
CVSS assessments
| Provider | Version | Score | Vector |
|---|---|---|---|
| NVD / [email protected] (Secondary) | 3.0 | 3.3 LOW | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| CNA / hackerone | 3.0 | 3.3 LOW | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected products and packages
CNA (CVE.org)
| Vendor | Product | Versions |
|---|---|---|
| nodejs | node | affected: 22.23.3 … <= 22.23.3 affected: 24.22.0 … <= 24.22.0 affected: 26.12.0 … <= 26.12.0 default: unaffected |
Linux distribution status
Red Hat ↗ Fetching
Debian ↗
| Release | Package | Status | Fixed version / notes |
|---|---|---|---|
| bookworm | nodejs | open not yet assigned | |
| forky | nodejs | open not yet assigned | |
| sid | nodejs | open not yet assigned | |
| trixie | nodejs | open not yet assigned |
Ubuntu ↗ medium
| Release | Package | Status | Fixed version / notes |
|---|---|---|---|
| bionic | nodejs | needs-triage | |
| focal | nodejs | needs-triage | |
| jammy | nodejs | needs-triage | |
| noble | nodejs | needs-triage | |
| resolute | nodejs | needs-triage | |
| stonking | nodejs | needs-triage | |
| trusty | nodejs | needs-triage | |
| xenial | nodejs | needs-triage |