Node.js EUVD-2026-109103

Requires the experimental Node.js Permission Model to be explicitly enabled (--permission with --allow-fs-read/--allow-fs-write grants that use wildcard path specifications), and the attacker must already be able to execute code inside that restricted context. Node.js does not enable the Permission Model by default, so the overwhelming majority of installations are not exposed. Exploitation is further limited by a local attack vector and high attack complexity, and impact is partial (some improperly permitted file access) rather than full system compromise; the exact trigger beyond incorrect wildcard-node handling is not described in the available sources.

All signals point to a low-priority issue. The vendor rates CVE-2026-106071 as Low, and the supplied CVSS:3.0 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) scores 3.6, reflecting a local-only attack requiring high complexity, existing low-level privileges, and yielding only partial confidentiality/integrity impact with no availability loss. The vuln.today decision label is 'monitor', not act_now or emergency. No EPSS score is provided, there is no CISA KEV listing, and no PoC or exploit reference is present in the input (only the fix commit/release) - so this is 'no public exploit identified at time of analysis'. Crucially, the flaw lives in Node.js's opt-in experimental Permission Model (fs permission tree handling of wildcard nodes), which is disabled by default, so the realistic exposed population is far smaller than Node.js's overall footprint. This is a genuine low-risk, defense-in-depth fix rather than an urgent priority; there is no conflict among the severity signals.

An application runs Node.js with the experimental Permission Model enabled (--permission with wildcard --allow-fs-* path grants) to sandbox file access. Because the permission tree incorrectly resolves wildcard nodes, code executing within that restricted context can reach file paths that the policy should have denied, partially bypassing the intended fs restrictions. No public exploit was identified in the provided data, and exploitation requires local code execution already inside the restricted process.