CVE-2026-123829 is a permission model bypass vulnerability in Node.js recursive file watching on macOS and Windows. It allows processes with read permission on a directory to learn the names and timing metadata of files and directories within subdirectories they cannot read. This occurs because the native libuv watcher forwards file names without verifying read permissions on each path. The vulnerability does not expose file contents and requires files created by another actor under the watched directory. It affects Node.js versions 22.x, 24.x, and 26.x.