Node.js 26.x < 26.12.1 Multiple Vulnerabilities

The version of Node.js installed on the remote host is prior to 26.12.1. It is, therefore, affected by multiple vulnerabilities as referenced in the Wednesday, October 21, 2026 Security Releases advisory. - The ZipFile implementation returns attacker-controlled prefix bytes after a failed ZIP...

Node.js 26.0.0-26.12.0 - Permission Model Filesystem Over-Grant via Wildcard Radix Tree Lookup

Permission Model Filesystem Over-Grant via Wildcard Radix Tree Lookup vulnerability discovered by malikhamzaiqbal in WordPress npm Node.js versions 26.0.0-26.12.0...

CVE-2026-58043

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under --permission, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This...