Skip to content

CVE-2026-58043 on CTRL-OS 26.05

Aliases: CVE-2026-58043

Packages: nodejs_26

Status: In Progress

Advisory Information

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.

Under --permission, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist.

This vulnerability affects Node.js main, 22.x, 24.x, and 26.x.

Updates

2026-07-30 22:55 CEST

Metadata changes:

  • Status for package nodejs_26: “In Progress” (a6abe93a895cbf1f25e32ea040f3b2d2b542bf8b)

2026-07-30 22:55 CEST

Metadata changes:

  • Status for package nodejs_24: “In Progress” (82840a825b134d25d7b4275553879fe460aafa0c)

2026-07-30 22:55 CEST

Metadata changes:

  • Status for package nodejs_22: “In Progress” (ad2af6b9d08c219840802e380ff5d088f47b6c74)

2026-07-30 22:51 CEST

Metadata changes:

  • Status for package nodejs_22: “New”
  • Status for package nodejs_24: “New”
  • Status for package nodejs_26: “New”