{
  "threat_severity" : "Important",
  "public_date" : "2026-07-30T06:02:50Z",
  "bugzilla" : {
    "description" : "nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw",
    "id" : "2509171",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2509171"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-551",
  "details" : [ "A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.\nUnder `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist.\nThis vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**.", "A flaw in the Node.js Permission Model allows attackers to bypass --permission restrictions, enabling unauthorized read or write access to files and directories." ],
  "statement" : "This Important flaw in Node.js allows an attacker, when the Permission Model is enabled, to bypass intended filesystem access restrictions. An attacker with initial access to a permitted path could read from or write to unauthorized locations, leading to a privilege escalation within the application's sandboxing.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-08-31T00:00:00Z",
    "advisory" : "RHSA-2026:61376",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "nodejs22-1:22.23.2-1.el10_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-08-31T00:00:00Z",
    "advisory" : "RHSA-2026:61377",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "nodejs24-1:24.19.0-1.el10_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10.0 Extended Update Support",
    "release_date" : "2026-09-08T00:00:00Z",
    "advisory" : "RHSA-2026:64817",
    "cpe" : "cpe:/o:redhat:enterprise_linux_eus:10.0",
    "package" : "nodejs22-1:22.23.2-1.el10_0"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-09-01T00:00:00Z",
    "advisory" : "RHSA-2026:62219",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "nodejs:22-8100020260819113925.6d880403"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-09-02T00:00:00Z",
    "advisory" : "RHSA-2026:62583",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "nodejs:24-8100020260819113942.6d880403"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-08-31T00:00:00Z",
    "advisory" : "RHSA-2026:61383",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "nodejs:22-9080020260819113937.rhel9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-08-31T00:00:00Z",
    "advisory" : "RHSA-2026:61386",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "nodejs:24-9080020260819113946.rhel9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.6 Extended Update Support",
    "release_date" : "2026-09-02T00:00:00Z",
    "advisory" : "RHSA-2026:62416",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.6",
    "package" : "nodejs:22-9060020260901085634.rhel9"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-07-29T00:00:00Z",
    "advisory" : "RHSA-2026:48273",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "nodejs26-main-26.5.1-1.5.hum1",
    "impact" : "important"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-07-29T00:00:00Z",
    "advisory" : "RHSA-2026:48305",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "nodejs22-main-22.23.2-2.3.hum1",
    "impact" : "important"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-07-30T00:00:00Z",
    "advisory" : "RHSA-2026:48537",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "nodejs24-main-24.18.1-0.1.hum1",
    "impact" : "important"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "nodejs:26/nodejs",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "fix_state" : "Not affected",
    "package_name" : "nodejs20",
    "cpe" : "cpe:/a:redhat:hummingbird:1"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "fix_state" : "Not affected",
    "package_name" : "nodejs25",
    "cpe" : "cpe:/a:redhat:hummingbird:1"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-58043\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-58043\nhttps://nodejs.org/en/blog/vulnerability/july-2026-security-releases" ],
  "name" : "CVE-2026-58043",
  "mitigation" : {
    "value" : "Avoid enabling the Node.js Permission Model by not using the `--permission` flag when starting Node.js applications. This prevents the vulnerable enforcement mechanism from being active. Disabling the Permission Model may remove an intended security layer if your application relies on it for sandboxing.",
    "lang" : "en:us"
  },
  "csaw" : false
}