CVE-2026-58039
A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths. This can lead to confidentiality impact or bypass of the intended se
nodejs nodeRuntimes & languagesCVSS
3.3LowExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.15%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version yet
What fixes it
No source in this snapshot names a fixed version.
Timeline
- 31 Jul 2026, 00:18 UTCPublishedCVE List
- 23 Oct 2026, 23:45 UTCExploit code publicGitHub proof-of-concept repositories
Reports 1
1 outlet mention it. Reports are not confirmation; each links to its source.
Description
A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths.
This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.
This vulnerability affects Node.js 22.x, 24.x, and 26.x.
Text from CVE List
Affected versions 3
- nodeaffected: 26.5.0 through 26.5.0CVE List
- nodeaffected: 24.18.0 through 24.18.0CVE List
- nodeaffected: 22.23.1 through 22.23.1CVE List