This page tracks the Alpine Linux fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-58043 →
ALPINE-CVE-2026-58043
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attac...
Original description
The description as published by the source.
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.
Under --permission, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist.
This vulnerability affects Node.js main, 22.x, 24.x, and 26.x.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Alpine:v3.21
nodejs
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.23.2-r0"}]}]
Alpine:v3.22
nodejs
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.23.2-r0"}]}]
Alpine:v3.23
nodejs
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.18.1-r0"}]}]
Alpine:v3.24
nodejs
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.18.1-r0"}]}]
References
- advisory security.alpinelinux.org