CVE-2026-58043 Missing authorization in node
Attackers can bypass Node.js permission model restrictions to read or write files outside the allowed paths when the permission flag is enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-58043?
CVE-2026-58043 is a high-severity missing authorization vulnerability in Nodejs Node.js, published on 30 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**.
Weakness: CWE-284
Which versions are affected by CVE-2026-58043?
2 open source packages ship an affected version, including node and node-min. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
node Bitnami | All versions | 22.23.2, 24.18.1, 26.5.1 |
node-min Bitnami | All versions | 22.23.2, 24.18.1, 26.5.1 |
Products include Nodejs Node.js.
How do I fix CVE-2026-58043?
Upgrade node to a fixed version for your release line: 22.23.2, 24.18.1 or 26.5.1.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-58043 being exploited?
There is no known exploitation of CVE-2026-58043 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Nodejs Node.js
Sources
Also known as ALPINE-CVE-2026-58043, AZL-94346, BELL-CVE-2026-58043, BIT-node-2026-58043, BIT-node-min-2026-58043, CLEANSTART-2026-RX91523 and 12 more.