Node.js implements a permission model that controls file system access via command-line flags such as --allow-fs-read and --allow-fs-write. The flaw causes a radix tree lookup to stop prematurely when the requested path is shorter than the prefix granted by a wildcard, so a grant like --allow-fs-read=/etc/passwd.* incorrectly permits reading /etc/passwd. This allows an application running with elevated privileges or configured with such a wildcard to read arbitrary files that are not within the intended scope, leading to potential information disclosure. The weakness is an example of CWE-284, Improper Authorization.

The vulnerability impacts Node.js version 26.x. It was discovered in that release and has not yet been addressed in subsequent versions at the time of this advisory. Only the Node.js runtime and applications built on it that use the permission model are affected.

The CVSS score of 3.6 indicates a low to moderate severity. No EPSS score is available and the issue is not listed in CISA’s KEV catalog, suggesting that widespread exploitation has not been observed. An attacker must be able to supply or modify the command-line arguments or configuration used to launch Node.js. If the process runs with root or elevated privileges, the attacker can read arbitrary files on the system, making the risk largely contingent on deployment context and privilege level.