What is the CVSS score and severity of CVE-2026-111508?

CVE-2026-111508 is rated HIGH with a CVSS score of 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

CVE-2026-111508 HIGH · CVSS 7.7 · OpenJS Foundation — Node.js Runtime · 2026-10-27

CVE-2026-111508: Node.js Permission Model Filesystem Policy Bypass

Q: What versions are affected by CVE-2026-111508?

CVE-2026-111508 affects Node.js 20.x, 22.x, 24.x, 25.x / 26.x in Node.js Runtime (Node.js Permission Model Filesystem Policy Bypass).

Q: How do I patch or remediate CVE-2026-111508?

To remediate CVE-2026-111508, upgrade to the patched release: Node.js v20.20.4, v22.22.4, v24.16.0, v25.10.0 / v26.12.1. Upgrade Node.js to the patched October 2026 release line. Do not rely solely on --permission for untrusted multi-tenant code execution; pair it with Linux namespaces, seccomp, or microVM isolation.

A path canonicalization flaw in the Node.js Permission Model (--permission) allows untrusted scripts using relative symlink traversal and Buffer-encoded paths to read or write files outside --allow-fs-read and --allow-fs-write boundaries.

Identifier

CVE-2026-111508

Vendor / Product

OpenJS Foundation · Node.js Runtime

Severity / CVSS

HIGH · CVSS 7.7

Vector / CWE

CWE-22 (Improper Limitation of a Pathname to a Restricted Directory)

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected

Node.js 20.x, 22.x, 24.x, 25.x / 26.x

Patched Version

Node.js v20.20.4, v22.22.4, v24.16.0, v25.10.0 / v26.12.1

Priority

P2 — Upgrade Node.js & Use OS-Level Sandboxing

Executive Summary & Technical Impact

Tracked under CVE-2026-111508 (CWE-22 (Improper Limitation of a Pathname to a Restricted Directory)), this vulnerability affects Node.js 20.x, 22.x, 24.x, 25.x / 26.x and carries a severity score of 7.7 (HIGH). Engineering and security operations teams running Node.js Runtime should prioritize upgrading to Node.js v20.20.4, v22.22.4, v24.16.0, v25.10.0 / v26.12.1.

Remediation & Patch Guidance

Upgrade Node.js to the patched October 2026 release line.
Do not rely solely on --permission for untrusted multi-tenant code execution; pair it with Linux namespaces, seccomp, or microVM isolation.

Frequently Asked Questions (CVE-2026-111508)

What versions are affected by CVE-2026-111508?

CVE-2026-111508 affects Node.js 20.x, 22.x, 24.x, 25.x / 26.x in Node.js Runtime (Node.js Permission Model Filesystem Policy Bypass).

How do I patch or remediate CVE-2026-111508?

Upgrade affected deployments to Node.js v20.20.4, v22.22.4, v24.16.0, v25.10.0 / v26.12.1 and verify the remediation steps listed above.

What is the CVSS score of CVE-2026-111508?

CVE-2026-111508 is rated HIGH with a CVSS score of 7.7 (vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

Full TechPulse Investigation

Node.js October 2026 Security Emergency: Brotli RCE (CVE-2026-111497) & TLS Validation Bypass

A deep technical breakdown of the October 2026 Node.js security releases addressing a critical out-of-bounds write in the bundled Brotli decoder and NUL byte DNS truncation.

Read full engineering post-mortem (7 min read) →