How can I disable these URLs?

When users try to access a path that doesn't exist, for example /node/5/random-text-2, Drupal will show the parent page. More exactly, it will show the page for the first of the following paths that exists. (% is the wildcard character, used for paths defined from modules.)

• node/5/%
• node/%/random-text-2
• node/%/%
• node/5
• node/%
• node

Normally, Drupal would show the page for node/5 (which is considered the parent page for node/5/random-text-2), but when a module defines a page for node/%/%, Drupal will instead show that page.

A module could add a hook_menu() implementation similar to the following one.

function mymodule_menu() {
  $items['node/%/%'] = array(
    'page callback' => 'mymodule_page',
  );

  return $items;
}

mymodule_page() could just show a 404 or a 403 error.

function mymodule_page() {
  // Return a 404 error.
  return MENU_NOT_FOUND;
}

This would stop Drupal from showing a node page every time users access a path like node/[node-id]/[random-string], where the random string doesn't match with any menu defined from any module. (For example, if [random-string] is equal to edit, Drupal will show the node edit form.)

Returning a 403 error is simpler. Using the following hook implementation, a module would get that without writing much code (except eventually an empty function for the page callback).

function mymodule_menu() {
  $items['node/%/%'] = array(
    'page callback' => 'mymodule_page',
    'access callback' => FALSE,
  );

  return $items;
}