Search: CVE-2026-106073

Node.js versions 22.23.3, 24.22.0, and 26.12.0 contain an improper access control vulnerability in the filesystem permission model. The function fs.realpathSync() lacks required read permission checks, allowing restricted code to bypass intended filesystem read restrictions. This is a partial regression of a previous fix that only covered fs.realpathSync.native().