# CVE-2026-58039: Node.js Permission Model bypass in process.report

Source: https://junglewise.ai/threats/cve-2026-58039-node-js-permission-model-bypass-in-process-report  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-31. Updated: 2026-07-31  
License: CC BY 4.0 with a link back

CVE-2026-58039 · Severity: low · CVSS 3.3 · Published 2026-07-31

A security flaw has been identified in Node.js, a widely used platform for running server-side applications. The issue involves a failure in the system's permission model, which is designed to restrict where the application can write files. An attacker with local access could exploit this to write or overwrite files in locations that should be protected, potentially leading to the exposure of sensitive information or a bypass of security boundaries.

## Quick answers

**Is CVE-2026-58039 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58039 being exploited in the wild.

**How severe is CVE-2026-58039?** Low severity, with a CVSS score of 3.3, published 31 July 2026.

**Which products and versions are affected?** Node.js Foundation Node.js 22.x, 24.x, 26.x.

**Is there a fix for CVE-2026-58039?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-58039 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-58039?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability classified as Improper Access Control (CWE-284) exists in the Node.js Permission Model. The root cause is a failure to properly enforce file system write restrictions during the execution of the 'process.report' function. This allows an attacker with local access to write or overwrite files outside of the paths explicitly permitted by the '--allow-fs-write' flag. The exploit requires local access with low privileges and no user interaction. This can result in a bypass of intended security boundaries and potential confidentiality impacts. The issue affects Node.js versions 22.x, 24.x, and 26.x.

## Affected products

- Node.js Foundation Node.js 22.x, 24.x, 26.x

## Timeline

- 2026-07-31: disclosed
- 2026-07-31: advisory

## References

- [https://nodejs.org/en/blog/vulnerability](https://nodejs.org/en/blog/vulnerability)