Threats tagged 'bit-node-2026-106071'

A flaw in the Node.js Permission Model for filesystem enforcement allows access to filesystem paths that do not exactly match a wildcard permission rule. Specifically, when a requested path is shorter than the prefix of a wildcard grant, the permission check incorrectly treats it as a match, potentially granting unintended access. This affects Node.js versions 25.0.0 up to but not including 26.12.1 and is fixed in version 26.12.1.