CVE-2026-58043Disclosure(nodejs / node.js)

LOWCVSS 8.4 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch nodejs node.js systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**.

nodejs CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://nodejs.org/en/blog/vulnerability/july-2026-security-releases

Weakness type (CWE)

CWE-284

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

node.js

Threat summary

Patch or workaround signal is available
7 mentions across 5 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 6 signals
Disclosure: 3 classified signals
General: 2 classified signals
Peaked 4d ago at 2 mentions (2026-07-30); latest day: 1
7 total mentions across 5 days

Affected systems

Vendors

nodejs

Products

node.js

Deep dive

Activity timeline7 mentions / 5d

Signal classification3 categories

Disclosure

342.9%

Patch

228.6%

General

228.6%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-30	2	Disclosure1Patch1
2026-08-07	1	Patch1
2026-08-20	2	General2
2026-09-02	1	Disclosure1
2026-10-04	1	Disclosure1

Full discourse7 posts

Netlas.io@Netlas_io91d
Disclosure
CVE-2026-56846, CVE-2026-56848 & CVE-2026-58043 and other: 3 high-severity and 8 medium or low vulnerabilities in Node.js ‍🔥 Recently disclosed vulnerabilities in Node.js touch HTTP/2, the Permission Model, and several core modules. 👉 https://nt.ls/AAg1f
Post summary
Three high‑severity and eight medium/low vulnerabilities in Node.js were recently disclosed, impacting HTTP/2, the permission model, and various core modules, but no PoC, exploit, patch, or active exploitation details are provided.
03091676
7.7K followersView on X
HeroDevs@herodevs70d
General
The board never gets bigger. The tail does. 🐍 CVE-2026-58043: High-severity allowlist bypass in the Node.js Permission Model. CVSS 7.5. Grant /data/secret1, /data/secret2, /data/secret3 and the radix tree splits at /data/secret — marking that boundary granted. A file nobody allowlisted becomes readable. #NodeJS #CVE
Post summary
The tweet announces a high‑severity allowlist bypass in Node.js (CVE‑2026‑58043) with CVSS 7.5, highlighting how the radix tree boundary can expose unallowlisted files, but it does not mention exploits, patches, or active attacks.
10000193
2.7K followersView on X
iototsecnews@iototsecnews83d
Patch
Node.js の 11件の脆弱性が FIX：不正なファイル・システム・アクセスやメモリ破壊の恐れ https://iototsecnews.jp/2026/07/30/node-js-fixes-11-security-flaws-that-can-crash-servers-and-break-filesystem-restrictions/ Node.js において、HTTP/2 処理や実行権限管理の不備に起因する複数の脆弱性 CVE-2026-56846／CVE-2026-56848／CVE-2026-58043 などが公表されました。この問題は、通信処理時のメモリ制限回避や、データ解放後の不正アクセス、アクセス許可領域の誤判定などに起因しています。悪用された場合には、サーバ・メモリの枯渇によるサービス停止や、意図しないファイル読み書き、システム・クラッシュが引き起こされる恐れがあります。対応策として、修正パッチが適用された最新バージョンへの速やかな移行や、本番環境での動作検証が有効です。システムを安全に利用するためにも、依存ライブラリを含めた環境のアップデートを実施することが推奨されます。 #CVE202656846 #CVE202656847 #CVE202656848 #CVE202656850 #CVE202658039 #CVE202658040 #CVE202658041 #CVE202658042 #CVE202658043 #CVE202658044 #CVE202658045 #Node.js #Vulnerability
Post summary
The article announces that several newly disclosed Node.js vulnerabilities have been fixed in the latest releases and urges users to apply the available patches and verify functionality in production environments.
01000167
505 followersView on X
Praveen SA 🙏@praveensacharya25d
Disclosure
Recent Key Vulnerabilities Affecting Node.js 20 Prior to and surrounding its EOL timeline, several critical security issues were identified that impact the Node.js 20.x runtime line:😁 • HTTP/2 RST_STREAM Heap Use-After-Free (CVE-2026-56848): A High severity flaw where a remote, unauthenticated attacker can trigger a process crash. The HTTP/2 server can force a stream write that re-enters session memory allocation while it is still processing received frames, resulting in an availability denial-of-service (DoS). • Permission Model Radix-Tree Over-Grant (CVE-2026-58043): A High severity issue where a flaw in prefix boundary handling allows an attacker with partial filesystem access to read or write to paths completely outside the intended restricted allowlist. • HTTP/2 Resource Exhaustion (CVE-2026-56846): A High severity memory flaw where retained header blocks escape the maxSessionMemory limit, allowing a remote client to consume all process memory and force a crash. • Bypass File System Permissions via Symlinks (CVE-2025-55130): A High severity flaw in the Permissions model where path restrictions (--allow-fs-read and --allow-fs-write) can be escaped using relative symbolic links, enabling unauthorized system file access. • TLS Callback Exceptions DoS (CVE-2026-21637): A Medium severity bug where synchronous exceptions thrown inside pskCallback or ALPNCallback bypass standard TLS error paths, causing file descriptor leaks or sudden process termination.
Post summary
The text discloses multiple vulnerabilities affecting Node.js 20.x with technical details and severity ratings, but does not mention PoCs, functional exploits, active exploitation, or available patches.
0000066
309 followersView on X
IntegSec@integ_sec57d
Disclosure
CVE-2026-58043: Node.js Permission Model Filesystem Allowlist Bypass - What It Means for Your Business and How to Respond https://hubs.li/Q04wh7cX0
Post summary
The text announces CVE-2026-58043, noting it is a Node.js allowlist bypass, but provides no PoC, exploit details, evidence of active exploitation, or patch/workaround information.
0000033
36 followersView on X
HeroDevs@herodevs70d
General
Learn more about CVE-2026-58043 🔗 https://www.herodevs.com/blog-posts/cve-2026-58043-node-js-permission-model-filesystem-allowlist-bypass?utm_source=x-twitter&utm_medium=organic-social&utm_campaign=node-nes_global&utm_content=post_none_20260820_a
Post summary
The tweet merely points readers to a blog post for more information on CVE-2026-58043, providing no additional context or technical details.
0000047
2.7K followersView on X
TECHEPAGES@techepages91d
Patch
Node.js has patched 11 security flaws across its 22.x, 24.x, and 26.x release lines, with patched versions 22.23.2, 24.18.1, and 26.5.1 released July 29. Top high-severity issues include an HTTP/2 memory exhaustion bug (CVE-2026-56846), a use-after-free flaw in HTTP/2 processing (CVE-2026-56848), and a Permission Model bypass (CVE-2026-58043) letting attackers escape restricted filesystem paths. 🔵 Also fixed: TLS identity leakage across cert configs, incomplete hostname verification, and an HTTP request smuggling risk via header truncation 🔵 Upgrade immediately — EOL versions remain unpatched and exposed
Post summary
Node.js releases updated versions that patch 11 critical security flaws, including memory exhaustion and permission bypass bugs, with a clear call for immediate upgrade of unpatched, end‑of‑life releases.
0000054
36 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	nodejs	node.js	-	-	-

Explore more

Back to dashboard nodejs CVEs node.js vulnerabilities

What researchers are saying

CVE-2026-58043

Netlas.io[verified]@Netlas_ioDisclosure

Three high‑severity and eight medium/low vulnerabilities in Node.js were recently disclosed, impacting HTTP/2, the permission model, and various core modules, but no PoC, exploit, patch, or active exploitation details are provided.

HeroDevs[verified]@herodevsGeneral

The tweet announces a high‑severity allowlist bypass in Node.js (CVE‑2026‑58043) with CVSS 7.5, highlighting how the radix tree boundary can expose unallowlisted files, but it does not mention exploits, patches, or active attacks.

Praveen SA 🙏[verified]@praveensacharyaDisclosure

The text discloses multiple vulnerabilities affecting Node.js 20.x with technical details and severity ratings, but does not mention PoCs, functional exploits, active exploitation, or available patches.

IntegSec[verified]@integ_secDisclosure

The text announces CVE-2026-58043, noting it is a Node.js allowlist bypass, but provides no PoC, exploit details, evidence of active exploitation, or patch/workaround information.

HeroDevs[verified]@herodevsGeneral

The tweet merely points readers to a blog post for more information on CVE-2026-58043, providing no additional context or technical details.

TECHEPAGES[verified]@techepagesPatch

Node.js releases updated versions that patch 11 critical security flaws, including memory exhaustion and permission bypass bugs, with a clear call for immediate upgrade of unpatched, end‑of‑life releases.

iototsecnews@iototsecnewsPatch

The article announces that several newly disclosed Node.js vulnerabilities have been fixed in the latest releases and urges users to apply the available patches and verify functionality in production environments.