CVE-2026-106073
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.re
nodejs nodeRuntimes & languagesCVSS
3.3LowExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Timeline
- 23 Oct 2026, 16:15 UTCPublishedCVE List
- 23 Oct 2026, 23:48 UTCExploit code publicGitHub proof-of-concept repositories
Reports 2
1 outlet mention it. Reports are not confirmation; each links to its source.
- CompleteTech-LLC/node-cve-2026-106073-check: Standalone defensive checker project for CVE-2026-106073: Node.js: Permission Model realpathSync read bypass. One exploit per repository; implementation pending.GitHub proof-of-concept repositories, 23 Oct 2026Exploit code
- completetech-security/node-cve-2026-106073-check: Standalone defensive checker project for CVE-2026-106073: Node.js: Permission Model realpathSync read bypass. One exploit per repository; implementation pending.GitHub proof-of-concept repositories, 23 Oct 2026Exploit code
Description
A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync() without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered fs.realpathSync.native().
As a result, code running under --permission with restricted --allow-fs-read can still use fs.realpathSync() to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.
This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Text from CVE List
Affected versions 3
- nodeaffected: 22.23.3 through 22.23.3CVE List
- nodeaffected: 24.22.0 through 24.22.0CVE List
- nodeaffected: 26.12.0 through 26.12.0CVE List