CVE-2026-106073: CWE-284 Improper Access Control - Generic in nodejs node

CVE-2026-106073 is a vulnerability in Node.js affecting versions 22.23.3, 24.22.0, and 26.12.0. The issue arises because fs.realpathSync() lacks proper read permission enforcement under the Node.js permission model, allowing code running with restricted --allow-fs-read permissions to check file existence, resolve symbolic link targets, and enumerate filesystem paths outside allowed directories. This is an incomplete fix of CVE-2026-21715, which only addressed fs.realpathSync.native(). The vulnerability has a CVSS 3.0 base score of 3.3 (low severity) with local attack vector, low complexity, low privileges required, no user interaction, and limited confidentiality impact.

The vulnerability allows local code with limited filesystem read permissions to bypass these restrictions and access information about files and directories outside the permitted scope. This can lead to unauthorized information disclosure but does not affect system integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid running untrusted code with restricted filesystem read permissions relying solely on fs.realpathSync() for access control enforcement.