CVE-2026-58039
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Node.js versions 22.x, 24.x, and 26.x have a vulnerability in the Permission Model that allows process.report to write (and overwrite) files outside --allow-fs-write paths. This can lead to confidentiality impact or bypass of the intended security boundary.
Risk Assessment
An attacker can write files outside allowed locations, potentially leading to leakage of sensitive data or modification of critical system files.
Recommendation
Update Node.js to the latest patch version for the respective branch (22.x, 24.x, 26.x) that includes a fix for this issue.
Original NVD description (English source)
A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.