CVE-2026-106071
Quick assessment
Affected
nodejs node
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Node.js 权限模型在文件系统强制访问控制方面存在一个缺陷，该缺陷可能导致访问那些不匹配通配符 或 规则的路径。 当请求的路径短于通配符授权规则的前缀时，基数树（radix tree）查找会提前停止比较，并将该路径视为匹配项。例如，设置 时，系统也会允许读取 。此问题仅发生在通配符授权规则直接位于权限树根节点下的情况（例如，当该作用域下仅有此一条授权规则时）。该漏洞的根本原因与 CVE-2026-58043 不同。 此漏洞影响 Node.js 26.x 版本。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-106071
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule.
When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, `--allow-fs-read=/etc/passwd.*` also allows reading `/etc/passwd`. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043.
This vulnerability affects Node.js **26.x**.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
访问控制不恰当
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-106071
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-106071
请登录查看更多情报信息。
Security Blog Posts for CVE-2026-106071 (1)
Same Patch Batch · nodejs · 2026-10-23 · 9 CVEs total
| CVE-2026-105481 | Node.js 22/24/26.x HTTP 代理连接重用漏洞 | |
| CVE-2026-105482 | Node.js 22/24/26.x DNS 解析空字节截断漏洞 | |
| CVE-2026-105483 | Node.js 24.x/26.x TLS 主机验证绕过漏洞 | |
| CVE-2026-106074 | Node.js 22/24/26 crypto 快照熵缓存漏洞 | |
| CVE-2026-106069 | Node.js 22/24/26 TLS 主机验证漏洞 | |
| CVE-2026-106070 | Node.js 26.x 中 zlib.ZipFile API 的任意字节读取漏洞 | |
| CVE-2026-106072 | Node.js 22/24/26 TLS 主机验证绕过漏洞 | |
| CVE-2026-106073 | Node.js 22/24/26 权限模型文件路径绕过漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-106071
No comments yet