CVE-2026-58039

Awaiting Analysis Awaiting Analysis - Queue

Permission Model Bypass in Node.js via process.report

Publication date: 2026-07-31

Last updated on: 2026-10-23

Assigner: HackerOne

Description

A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-31

Last Modified

2026-10-23

Generated

2026-11-08

AI Q&A

2026-07-31

EPSS Evaluated

2026-11-07

NVD

CVE-2026-58039

EUVD

EUVD-2026-51369

Affected Vendors & Products

Vendor	Product	Version / Range
nodejs	node.js	From 22.0.0 (inc) to 23.0.0 (exc)
nodejs	node.js	From 24.0.0 (inc) to 25.0.0 (exc)
nodejs	node.js	From 26.0.0 (inc) to 27.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability is a flaw in Node.js's Permission Model enforcement. It allows the process.report feature to write or overwrite files outside the designated --allow-fs-write paths. This can lead to unauthorized file access or modification, potentially bypassing intended security boundaries.

Detection Guidance

To detect this vulnerability, check Node.js versions 22.x, 24.x, or 26.x and verify if process.report is enabled with write permissions outside allowed paths. Inspect file system writes by process.report for unexpected file modifications or new files in restricted directories.

Impact Analysis

The impact includes potential confidentiality breaches if sensitive files are accessed or overwritten. It may also allow bypassing security restrictions, leading to unauthorized actions within the system. Affected users are those running Node.js versions 22.x, 24.x, or 26.x.

Compliance Impact

This vulnerability could lead to unauthorized file writes outside intended paths, potentially exposing sensitive data. This may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information if exploited.

Mitigation Strategies

Update Node.js to the latest patched version for your release line (22.x, 24.x, or 26.x). Avoid using --allow-fs-write with process.report unless absolutely necessary. Review file system permissions to restrict write access to sensitive directories.

Hi! I’m here to help you understand CVE-2026-58039. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...