Loading vulnerability…
Node.js process.report Filesystem Write Permission Bypass
CVE-2026-58039 is an authorization enforcement flaw in the Node.js Permission Model affecting the 22.x, 24.x, and 26.x release lines. The process.report functionality can write diagnostic reports, including overwriting existing files, outside locations authorized by --allow-fs-write. Under affected configurations, this bypasses the intended filesystem-write boundary and can expose confidential information.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits unauthorized diagnostic-report writes or overwrites outside the configured filesystem-write allowlist, subject to the process's operating-system permissions. Reports written to unintended locations may expose confidential information. The vulnerability is rated Low, with a reported CVSS v3 score of 3.3; arbitrary code execution and operating-system privilege escalation are not established.
If you can’t patch tonight, do this now.
No vulnerability-specific vendor workaround is documented. Until patched, do not rely solely on the Node.js Permission Model to contain process.report writes; use operating-system filesystem permissions or external sandboxing to restrict the process's writable locations.
Patch, then assume compromise.
Upgrade Node.js to 22.23.2, 24.18.1, or 26.5.1, or a later security-supported release on the corresponding branch. For Alpine Linux nodejs-current packages, upgrade to 26.5.1-r0 or later. For Debian 13 (trixie), install nodejs 20.19.2+dfsg-1+deb13u3 or a later Debian security update. Update bundled Node.js runtimes through the applicable product or buildpack security release.
No validated public exploits yet. Hidden: 3 rejected by Mallory's analysis as not a working exploit.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.