CVE-2026-106073

A flaw in the Node.js Permission Model filesystem enforcement allows the fs.realpathSync() function to bypass required read permission checks. This is an incomplete fix for CVE-2026-21715 , which only addressed fs.realpathSync.native(). Consequently, code executing under the --permission flag wit...