What is the CVSS score of CVE-2026-58043?

CVE-2026-58043 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Node.js are affected by CVE-2026-58043?

Node.js versions 22.x through 22.23.1, 24.x through 24.18.0, and 26.x through 26.5.0 contain a local privilege escalation vulnerability in the permission model feature (--permission flag) that allows…. A patch is available.

How to fix or mitigate CVE-2026-58043?

Within 24 hours, identify all Node.js deployments using the --permission flag and document current versions to determine exposure scope. Within 7 days, obtain patched versions per vendor advisory and test them in non-production environments to validate application compatibility. Within 30 days, deploy the patched versions to all affected production systems; for environments where immediate patching is infeasible, disable the --permission flag as a temporary protective measure.

Node.js CVE-2026-58043

EUVD-2026-51021 HIGH

Improper Access Control (CWE-284)

2026-07-29

GHSA-qrq2-c54w-wgqm

Authentication Bypass Node.js Node Js

8.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.4 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

8.4 HIGH

Local process execution with low privilege required; scope changes as the host filesystem boundary is crossed; no availability impact from a path-bypass flaw.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

SUSE

7.5 HIGH

AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Red Hat

7.5 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Aug 25, 2026 - 18:14 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 25, 2026 - 18:07 vuln.today

cvss_changed

CVSS changed

Aug 25, 2026 - 18:07 NVD

7.5 (HIGH) 8.4 (HIGH)

Source Code Evidence Fetched

Jul 30, 2026 - 06:59 vuln.today

Analysis Generated

Jul 30, 2026 - 06:59 vuln.today

CVSS changed

Jul 30, 2026 - 06:37 NVD

7.5 (HIGH)

CVE Published

Jul 29, 2026 - 14:02 github-releases

HIGH 7.5

CVE Published

Jul 29, 2026 - 14:02 github-releases

UNKNOWN (no severity yet)

Description PRE-NVD

Disclosed via GitHub release of nodejs/node. NVD scoring and full description are pending.

AnalysisAI

Node.js's Permission Model - enabled via the --permission flag - incorrectly grants access rights when an internal radix tree node is split during path resolution, allowing a locally executing low-privileged process to escape its configured filesystem access policy on versions 22.x through 22.23.1, 24.x through 24.18.0, and 26.x through 26.5.0. The scope change in the CVSS vector (S:C, C:H, I:H) reflects that a successfully exploiting process can read and write files on the host filesystem beyond what its permission policy permits - effectively defeating the sandbox. No public exploit code exists and CISA KEV listing is absent; EPSS at 0.14% (3rd percentile) reflects that real-world exploitation is currently minimal, consistent with the non-default nature of the affected feature.

Technical ContextAI

The Node.js Permission Model, introduced to restrict filesystem, child-process, and worker access for running scripts, uses a radix tree data structure internally to match and enforce permitted path prefixes. CWE-284 (Improper Access Control) is the root cause: when the radix tree performs an internal node-split operation - a normal structural optimization when a new path prefix is inserted - the implementation was incorrectly granting permission to the newly created intermediate (split) node. This means paths that share a prefix with, but extend beyond, an explicitly allowed path could be permitted by accident. Affected products per CPE are cpe:2.3:a:nodejs:node.js for the LTS lines v22 and v24 and the Current line v26. The fix, attributed to maintainer RafaelGSS in commit af0bf96877-adjacent work in the private nodejs-private repository, was shipped in the July 2026 security release.

RemediationAI

Upgrade to Node.js 26.5.1 or the corresponding patched releases for the v22 and v24 LTS lines released in the July 2026 security release cycle; exact patched LTS versions beyond v26.5.1 should be confirmed at https://nodejs.org/en/blog/vulnerability/july-2026-security-releases. Red Hat users should apply RHSA-2026:48273, RHSA-2026:48305, or RHSA-2026:48537 as applicable to their platform. As an immediate compensating control for deployments that cannot patch, removing the --permission flag from Node.js invocations eliminates all exposure because the vulnerable radix tree code path is only reachable when the Permission Model is active - however, this trade-off also removes any filesystem access restrictions the flag was providing, potentially widening the attack surface in other ways. There is no known per-path workaround that preserves the Permission Model while avoiding the flaw.

More in Node.js

View all

CVE-2024-41713 CRITICAL Emergency POC

9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could

CVE-2024-55591 CRITICAL Emergency POC

9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote

CVE-2023-44487 HIGH Act Now POC

7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour

CVE-2014-7205 CRITICAL Act Now POC

10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t

CVE-2025-59528 CRITICAL Act Now POC

10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete

CVE-2017-14849 HIGH Act Now POC

7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc

CVE-2017-5941 CRITICAL Emergency POC

9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner

CVE-2014-0224 HIGH Act Now POC

7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph

CVE-2014-3744 HIGH Act Now POC

7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi

CVE-2014-9566 HIGH Act Now POC

7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin

CVE-2013-4660 MEDIUM This Month POC

6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic

CVE-2016-2107 MEDIUM This Month POC

5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

Same weakness CWE-284 – Improper Access Control

View all

CVE-2012-4681 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2012-1723 CRITICAL POC

9.8

CVE-2012-5076 CRITICAL POC

9.8

CVE-2014-3120 HIGH POC

8.1

CVE-2013-2423 LOW POC

3.7

CVE-2016-3427 CRITICAL

9.8

CVE-2025-12480 CRITICAL POC

9.1

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2022-40684 CRITICAL POC

9.8

CVE-2025-61882 CRITICAL POC

9.8

CVE-2024-0012 CRITICAL POC

9.3

CVE-2023-46805 HIGH POC

8.2

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS	Affected
SUSE Linux Enterprise Server 15 SP6-LTSS	Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP6	Affected
SUSE Linux Enterprise High Performance Computing 12	Affected

CVE-2026-58043 vulnerability details – vuln.today

Back

Node.js CVE-2026-58043

Severity by source

CVSS VectorNVD

Lifecycle Timeline

Description PRE-NVD

AnalysisAI

Technical ContextAI

RemediationAI

More in Node.js

Same weakness CWE-284 – Improper Access Control

Same technique Authentication Bypass

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code