Bug 2560018 (CVE-2026-106071)

Summary: CVE-2026-106071 nodejs: nodejs: Permission model bypass via wildcard path matching flaw
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: gtanzill, jbuscemi, kaycoth, rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Node.js Permission Model. Wildcard --allow-fs-read or --allow-fs-write rules can grant access to paths that do not match the intended wildcard when the requested path is shorter than the wildcard prefix and the radix-tree lookup stops comparing early. For example, --allow-fs-read=/etc/passwd.* may also allow reading /etc/passwd. This requires the wildcard grant to sit directly under the root of the permission tree (for example when it is the only grant for that scope). This is a different root cause from CVE-2026-58043 and affects the Node.js 26.x line.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2560634    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-23 16:22:10 UTC 
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule.

When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, `--allow-fs-read=/etc/passwd.*` also allows reading `/etc/passwd`. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043.

This vulnerability affects Node.js **26.x**.
Comment 3 Jon Orris 2026-10-29 14:21:08 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:92376 https://access.redhat.com/errata/RHSA-2026:92376
Comment 4 Jon Orris 2026-10-29 22:29:51 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:92378 https://access.redhat.com/errata/RHSA-2026:92378