CVE-2026-106071: CWE-284 Improper Access Control - Generic in nodejs node

This vulnerability arises from improper access control in Node.js's permission model for filesystem access. When a wildcard permission is granted (e.g., --allow-fs-read=/etc/passwd.*), the radix tree lookup used to verify paths stops comparing early if the requested path is shorter than the wildcard prefix. This causes paths that should not match the wildcard to be incorrectly allowed, such as /etc/passwd being accessible when only /etc/passwd.* was intended. The issue requires the wildcard grant to be directly under the root of the permission tree and is distinct from a separate vulnerability (CVE-2026-58043). The flaw affects Node.js version 26.12.0.

The vulnerability allows a process running with certain filesystem read or write permissions granted via wildcards to access files outside the intended scope. This could lead to unauthorized reading or writing of files that were not meant to be accessible under the specified wildcard rules. The impact is limited to confidentiality and integrity with low severity (CVSS 3.6), requiring local access with high attack complexity and low privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid relying on wildcard filesystem permission grants that could be exploited by this flaw, especially those placed directly under the root of the permission tree. Review and restrict filesystem permission rules to minimize exposure.