CVE-2026-106073

A flaw was found in the Node.js Permission Model. fs.realpathSync does not perform the filesystem read permission checks required of comparable fs APIs. This is an incomplete fix of CVE-2026-21715, which only covered fs.realpathSync.native. Code running under --permission with restricted...