nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)

Overview

A flaw was found in the Node.js Permission Model. Wildcard --allow-fs-read or --allow-fs-write rules can grant access to paths that do not match the intended wildcard when the requested path is shorter than the wildcard prefix and the radix-tree lookup stops comparing early. For example, --allow-fs-read=/etc/passwd.* may also allow reading /etc/passwd. This requires the wildcard grant to sit directly under the root of the permission tree (for example when it is the only grant for that scope). This is a different root cause from CVE-2026-58043 and affects the Node.js 26.x line.

Vendor advisories

• Red Hat VEX · Low · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-10-26 · vex

nodejs: nodejs: Permission model bypass via wildcard path matching flaw — rated Low by Red Hat. Released 2026-10-23, updated 2026-10-26.

Affected:

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9

No fix planned:

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9

Not affected:

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9
• Red Hat Hardened Images

Remediation

Fix deferred

Workarounds / mitigations:

• If the Permission Model is unused, do not enable --permission. When using --allow-fs-read/--allow-fs-write, avoid wildcard grants placed as the sole root-level rule; prefer explicit directory prefixes without ambiguous wildcards (CME-1303 Application-Level Filesystem Access Confinement: https://cmetaxonomy.org/entries/CME-1303.html). Combine application allowlists with OS confinement such as SELinux or container filesystem restrictions (CME-301: https://cmetaxonomy.org/entries/CME-301.html; CME…