CVE-2026-106073 A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks.
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-106073?
CVE-2026-106073 is a low-severity vulnerability in nodejs node, published on 23 Oct 2026.
Official description
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`.
As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.
This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
Weakness: CWE-284
Which versions are affected by CVE-2026-106073?
2 open source packages ship an affected version, including node and node-min.
| Package | Affected | Fixed in |
|---|---|---|
node Bitnami | All versions | 22.23.4, 24.22.1, 26.12.1 |
node-min Bitnami | All versions | 22.23.4, 24.22.1, 26.12.1 |
How do I fix CVE-2026-106073?
Upgrade node to a fixed version for your release line: 22.23.4, 24.22.1 or 26.12.1.
Is CVE-2026-106073 being exploited?
There is no known exploitation of CVE-2026-106073 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as ALPINE-CVE-2026-106073, AZL-111032, BIT-node-2026-106073, BIT-node-min-2026-106073, DEBIAN-CVE-2026-106073, GHSA-w63p-v5c6-3pmw and 1 more.