A flaw in Node.js’s Permission Model enforcement allows an attacker to over‑grant filesystem access by exploiting a radix‑tree prefix boundary handling bug. When the --permission option creates a permission tree, a user granted access to a single path can abuse the boundary logic to read or write files outside the intended allowlist. This leads to unauthorized disclosure or modification of data, compromising confidentiality, integrity, and potentially availability of the affected system.

The vulnerability affects Node.js releases labeled main, 22.x, 24.x, and 26.x. Any deployment running these versions and using the --permission feature is susceptible. No sub‑version ranges are specified, so the entire branches are considered impacted until a patch is applied.

The CVSS base score of 7.5 indicates a high impact, while the EPSS score of less than 1 % suggests a very low but non‑zero probability of exploitation. The vulnerability is not currently listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector requires an actor able to influence the --permission parameter, which could be a local user or a remote entity that can supply code to the Node.js process. Successful exploitation would grant read/write permissions beyond the intended scope, leading to information compromise or system compromise.