Patch Forecast
Amber warning
Patch this week.

CVE-2026-58043

Node.js: access control flaw

Risk score
66/100
CVSS
8.4 v3.1
Exploit chance (30 days)
0.2%
Published
30 Jul 2026

Open in the live forecast Today's forecast

What to know

What it is
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries, allowing an attacker to read from or write to unintended paths.
Affected
{'products': ['Node.js'], 'packages': [], 'versions': ['main', '22.x', '24.x', '26.x']}
Fix
Check the linked advisory for the concrete fix, as the record does not specify an action.
Exploitation
No known exploitation

Story map

Story map: Node.jsTHE FLAWSTHE FIXCVE-2026-58043Access control flawCVSS 8.4 · EPSS 0%CVE-2026-111497Out-of-bounds write can leadto remote code executionCVSS 9.2 · EPSS 1%CVE-2026-48930Access control flawCVSS 9.8 · EPSS 0%CVE-2026-48618Authentication bypassCVSS 6.5 · EPSS 3%FixUpdate to the latest availableversion: 1.0.10 or 1.1.1 or 1.2.1Who is exposed{'product': 'Google Brotli','packages': ['1.0.3', '1.0.4','1.0.5', '1.0.6', '1.0.7', '1.0.8','1.0.9', '1.0.10', '1.1.0', '1.1.1','1.2.0', '1.2.1'], 'versions'…RED · ACT TODAYNode.jsA buffer overflow vulnerabilityin the Brotli decoder of GoogleBrotli versions 1.0.3 through1.2.0 allows a remoteunauthenticated attacker topotentially execute arbitrarycode or cause a denial of service.Where it standsExploitation reported in the press1 outlet covering itHOW IT UNFOLDEDOfficial record on the left, the press on the right, oldest first.21 Oct · Node.js security releasesWednesday, October 21, 2026 Security Releases23 Oct · The Hacker NewsResearchers Demonstrate Node2Shell RCE Exploiton Node.js Build Using Crafted Brotli Data24 Oct · The Hacker NewsBrotli Decoder Flaw Behind Node.js RCE AlsoAffects Bun, Python and Other Widely UsedSoftwareCONNECTS TOSame weaknessAccess control flaw (CWE-284)324 other warnings in 30 days →Same productEarlier Node.js warnings11 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Node.js: Red, act today. A buffer overflow vulnerability in the Brotli decoder of Google Brotli versions 1.0.3 through 1.2.0 allows a remote unauthenticated attacker to potentially execute arbitrary code or cause a denial of service.

The flaws

The fix

Fix: Update to the latest available version: 1.0.10 or 1.1.1 or 1.2.1

Who is exposed: {'product': 'Google Brotli', 'packages': ['1.0.3', '1.0.4', '1.0.5', '1.0.6', '1.0.7', '1.0.8', '1.0.9', '1.0.10', '1.1.0', '1.1.1', '1.2.0', '1.2.1'], 'versions': ['1.0.3', '1.0.4', '1.0.5', '1.0.6', '1.0.7', '1.0.8', '1.0.9', '1.0.10', '1.1.0', '1.1.1', '1.2.0', '1.2.1']}

Where it stands

  • Exploitation reported in the press
  • 1 outlet covering it

How it unfolded

  1. 21 Oct, Node.js security releases (official): Wednesday, October 21, 2026 Security Releases
  2. 23 Oct, The Hacker News (press): Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
  3. 24 Oct, The Hacker News (press): Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software

Connects to

Why it is Amber

  • CVSS 8.4 high
  • On your watchlist: node.js
  • Named in a government or vendor bulletin

Government and vendor bulletins

References

Original description

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**.

Last activity 21 Oct 2026. Patch Forecast updates every hour.