CVE-2026-58043 is a vulnerability in the Node.js Permission Model that allows an attacker to bypass the intended filesystem access restrictions enforced by the '--permission' flag. When enabled, this flaw permits unauthorized read or write access to files and directories outside the permitted paths, resulting in potential privilege escalation within the sandboxed environment. Red Hat has issued a security advisory and released updated RPM packages for Red Hat Hardened Images including nodejs24 and nodejs26 components to address this issue. The advisory includes detailed information on the affected packages and versions, and recommends either applying the update or disabling the Permission Model to prevent exploitation.

The vulnerability enables an attacker with initial access to a permitted filesystem path to bypass permission restrictions and gain unauthorized read or write access to other files and directories. This can lead to privilege escalation within the Node.js application's sandbox, compromising confidentiality and integrity of data. The flaw affects Red Hat Hardened Images using Node.js with the Permission Model enabled.

A patch is available from Red Hat as updated RPM packages for the affected Node.js components in Red Hat Hardened Images. Users should apply these updates promptly. Alternatively, to mitigate the vulnerability without patching, avoid enabling the Node.js Permission Model by not using the '--permission' flag when starting Node.js applications. Note that disabling the Permission Model may remove an intended security layer if the application relies on it for sandboxing.