CVE-2026-106073
Quick assessment
Affected
nodejs node
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Node.js 权限模型在文件系统执行层面存在一个缺陷，导致 缺少必要的读取权限检查。这是对 CVE-2026-21715 的不完整修复，该 CVE 仅覆盖了 方法。 因此，在启用 标志并限制 的代码中，攻击者仍可利用 来检查文件是否存在、解析符号链接目标，以及枚举允许目录之外的文件系统路径。 该漏洞影响 Node.js 26.x、24.x 和 22.x 版本。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-106073
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`.
As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.
This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
访问控制不恰当
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-106073
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-106073
请登录查看更多情报信息。
Security Blog Posts for CVE-2026-106073 (1)
Same Patch Batch · nodejs · 2026-10-23 · 9 CVEs total
| CVE-2026-105481 | Node.js 22/24/26.x HTTP 代理连接重用漏洞 | |
| CVE-2026-105482 | Node.js 22/24/26.x DNS 解析空字节截断漏洞 | |
| CVE-2026-105483 | Node.js 24.x/26.x TLS 主机验证绕过漏洞 | |
| CVE-2026-106074 | Node.js 22/24/26 crypto 快照熵缓存漏洞 | |
| CVE-2026-106069 | Node.js 22/24/26 TLS 主机验证漏洞 | |
| CVE-2026-106071 | Node.js 26.x 权限模型文件系统漏洞 | |
| CVE-2026-106070 | Node.js 26.x 中 zlib.ZipFile API 的任意字节读取漏洞 | |
| CVE-2026-106072 | Node.js 22/24/26 TLS 主机验证绕过漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-106073
No comments yet