Commit 5faa1497e06 for nodejs

commit 5faa1497e06e6131e4c3048b5398d39dfa3fdeaf
Author: James M Snell <jasnell@gmail.com>
Date:   Sat Sep 19 21:31:14 2026 +0000

    src: fix the fs permission tree node on wildcard nodes

    Signed-off-by: James M Snell <jasnell@gmail.com>
    PR-URL: https://github.com/nodejs-private/node-private/pull/986
    Fixes: https://hackerone.com/reports/3996423
    CVE-ID: CVE-2026-106071

diff --git a/src/permission/fs_permission.h b/src/permission/fs_permission.h
index 2a5c838c14c..b009b66f648 100644
--- a/src/permission/fs_permission.h
+++ b/src/permission/fs_permission.h
@@ -129,8 +129,8 @@ class FSPermission final : public PermissionBase {
         }
         // match prefix
         size_t prefix_len = child->prefix.length();
-        for (size_t i = 0; i < path.length(); ++i) {
-          if (i >= prefix_len || child->prefix[i] == '*') {
+        for (size_t i = 0; i < prefix_len; ++i) {
+          if (child->prefix[i] == '*') {
             return child;
           }

diff --git a/test/parallel/test-permission-fs-wildcard.js b/test/parallel/test-permission-fs-wildcard.js
index 1b67f37c2dc..43e2465d46a 100644
--- a/test/parallel/test-permission-fs-wildcard.js
+++ b/test/parallel/test-permission-fs-wildcard.js
@@ -126,3 +126,34 @@ if (common.isWindows) {
     assert.strictEqual(status, 0, stderr.toString());
   }
 }
+
+{
+  // Each scope holds a single grant, so its wildcard node sits directly under
+  // the radix tree root. Removing the `*` and the character before it must not
+  // produce a granted path.
+  if (!common.isWindows) {
+    const { status, stderr } = spawnSync(
+      process.execPath,
+      [
+        '--permission',
+        '--allow-fs-read=/tmp/test*',
+        '--allow-fs-write=/tmp/test/*',
+        '-e',
+        `
+        const assert = require('assert');
+        assert.ok(process.permission.has('fs.read', '/tmp/test'));
+        assert.ok(process.permission.has('fs.read', '/tmp/test2'));
+        assert.ok(process.permission.has('fs.read', '/tmp/test/file'));
+        assert.ok(!process.permission.has('fs.read', '/tmp/tes'));
+        assert.ok(!process.permission.has('fs.read', '/tmp/te'));
+        assert.ok(process.permission.has('fs.write', '/tmp/test'));
+        assert.ok(process.permission.has('fs.write', '/tmp/test/'));
+        assert.ok(process.permission.has('fs.write', '/tmp/test/file'));
+        assert.ok(!process.permission.has('fs.write', '/tmp/tes'));
+        assert.ok(!process.permission.has('fs.write', '/tmp/test2'));
+      `,
+      ]
+    );
+    assert.strictEqual(status, 0, stderr.toString());
+  }
+}