CVE-2026-58043 describes a flaw in Node.js's permission enforcement mechanism related to filesystem access control. Specifically, the vulnerability arises from incorrect handling of radix-tree prefix boundaries under the --permission flag, enabling an attacker granted access to one filesystem path to access other paths outside the allowlist. This results in an over-granting of filesystem permissions, potentially allowing unauthorized read or write operations. The vulnerability affects Node.js main branch and versions 22.x, 24.x, and 26.x. The CVSS vector indicates local attack complexity is high, requires low privileges, no user interaction, and impacts confidentiality and integrity with a high severity rating. No known exploits in the wild or patch information is provided.

This vulnerability can lead to unauthorized disclosure and modification of filesystem data beyond the intended permission boundaries in Node.js environments using the --permission flag. Attackers with limited privileges can exploit this to escalate access to sensitive files or modify files outside their allowed scope, compromising confidentiality and integrity of the system. Availability impact is not indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid running Node.js with the --permission flag in untrusted environments or restrict usage to trusted code only. Monitor vendor channels for updates and apply patches promptly once released.