Node.js July 2026 security releases: 11 CVEs, including a Permission Model over-grant

What happened on 29 July

On 29 July 2026, Node.js released security versions v26.5.1, v24.18.1 and v22.23.2 (originally planned for 28 July, then postponed a day), fixing 11 CVEs and updating undici and llhttp. The high-severity issues included two in HTTP/2 and CVE-2026-58043, in which Permission Model path matching over-granted filesystem access across prefix boundaries, allowing reads or writes outside the allowlist under --permission. Two low-severity Permission Model issues let trace events and process.report write files outside --allow-fs-write paths. The rest covered mTLS identity and TLS session reuse in the HTTPS Agent, node:sqlite, DNS, zlib and HTTP parsing.

What it means for desktop and Node-packaged apps

For teams that ship a Node runtime with their product, such as single executable applications, desktop clients with a bundled runtime or local helper services, two points stand out. First, the Permission Model is a defense-in-depth mechanism that narrows what a process can reach, and several over-grant issues in one release show that its boundaries can themselves be wrong, so it should not be your only isolation layer. Second, it limits what code may access; it does not protect the code from being read or modified, and bundled JavaScript can be inspected whether or not the Permission Model is enabled. Meanwhile, a runtime you ship is a runtime you must update, because older copies on users' machines will not pick up these fixes on their own.

Checks you can run

First, confirm which Node version, or which Node release line, your product actually bundles, compare it against the advisory and schedule an update with the patched runtime. Second, if you use --permission or --allow-fs-write, re-test allowlist boundaries after upgrading, especially directory names that share a prefix. Third, review your app's use of HTTP/2, mTLS and DNS to assess exposure to the related issues, and add the runtime version to your pre-release checklist and software bill of materials. Finally, make sure your update mechanism can deliver a runtime change quickly, since a fix that sits unshipped protects no one.

Your checklist

• Identify the bundled Node version and schedule an update
• Re-test --permission allowlist boundaries after upgrading
• Track the runtime version in release checks and the SBOM