CVE-2026-21715
published 2026-03-30CVE-2026-21715: A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable…
PriorityP413low3.3CVSS 3.0
AVLACLPRLUINSUCLINAN
EPSS
0.16%
5.4th percentile
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them.
As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.
This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-read` is intentionally restricted.
Affected
26 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | nodejs | < nodejs 22.22.2+dfsg+~cs22.19.15-1 (forky) | nodejs 22.22.2+dfsg+~cs22.19.15-1 (forky) |
| nodejs | node | >= 10.0 < 10.* | 10.* |
| nodejs | node | >= 11.0 < 11.* | 11.* |
| nodejs | node | >= 12.0 < 12.* | 12.* |
| nodejs | node | >= 13.0 < 13.* | 13.* |
| nodejs | node | >= 14.0 < 14.* | 14.* |
| nodejs | node | >= 15.0 < 15.* | 15.* |
| nodejs | node | >= 16.0 < 16.* | 16.* |
| nodejs | node | >= 17.0 < 17.* | 17.* |
| nodejs | node | >= 18.0 < 18.* | 18.* |
| nodejs | node | >= 19.0 < 19.* | 19.* |
| nodejs | node | 20.20.1 – 20.20.1 | — |
| nodejs | node | 22.22.1 – 22.22.1 | — |
| nodejs | node | 24.14.0 – 24.14.0 | — |
| nodejs | node | 25.8.1 – 25.8.1 | — |
| nodejs | node | >= 4.0 < 4.* | 4.* |
| nodejs | node | >= 5.0 < 5.* | 5.* |
| nodejs | node | >= 6.0 < 6.* | 6.* |
| nodejs | node | >= 7.0 < 7.* | 7.* |
| nodejs | node | >= 8.0 < 8.* | 8.* |
| nodejs | node | >= 9.0 < 9.* | 9.* |
| nodejs | nodejs | >= 0 < 22.22.2-r0 | 22.22.2-r0 |
| nodejs | nodejs | >= 0 < 22.22.2-r0 | 22.22.2-r0 |
| nodejs | nodejs | >= 0 < 24.14.1-r0 | 24.14.1-r0 |
| nodejs | nodejs | >= 0 < 20.19.2+dfsg-1+deb13u2 | 20.19.2+dfsg-1+deb13u2 |
CVSS provenance
nvdv3.03.3LOWCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
osv3.3LOW
vendor_debian3.3LOW
vendor_redhat3.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-8jgr-5cgv-g667: A flaw in Node
ghsa_unreviewed·2026-03-30
CVE-2026-21715 [LOW] CWE-732 GHSA-8jgr-5cgv-g667: A flaw in Node
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them.
As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.
This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-read` is intentionally restricted.
OSV
CVE-2026-21715: A flaw in Node
osv·2026-03-30·CVSS 3.3
CVE-2026-21715 [LOW] CVE-2026-21715: A flaw in Node
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them. As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories. This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-read` is intentionally restricted.
OSV
CVE-2026-21715: A flaw in Node
osv·2026-03-30·CVSS 3.3
CVE-2026-21715 [LOW] CVE-2026-21715: A flaw in Node
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them.
As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.
This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-read` is intentionally restricted.
Red Hat
Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions
vendor_redhat·2026-03-30·CVSS 3.3
CVE-2026-21715 [LOW] CWE-425 Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions
Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them.
As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.
This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-read` is intentionally restricted.
A flaw was found in Node.js. The Node.js Permission Model, intended to restrict filesystem acces
Debian
CVE-2026-21715: nodejs - A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSyn...
vendor_debian·2026·CVSS 3.3
CVE-2026-21715 [LOW] CVE-2026-21715: nodejs - A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSyn...
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them. As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories. This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-read` is intentionally restricted.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 22.22.2+dfsg+~cs22.19.15-1)
sid: resolved (fixed in 22.22.2+dfsg+~cs22.19.15-1)
trixie: resolved (fixed in 20.19.2+dfsg-1+deb13u2)
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-21710 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
CVE-2026-21710 [HIGH] CVE-2026-21710 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21710 :
Node.js vulnerability analysis and mitigation
TypeError
__proto__
req.headersDistinct
dest["__proto__"]
Object.prototype
undefined
.push()
error
req.headersDistinct
try/catch
This vulnerability affects all Node.js HTTP servers on 20.x, 22.x, 24.x, and v25.x
Source : NVD
## 7.5
Score
Published March 30, 2026
Severity HIGH
CNA Score 7.5
Affected Technologies
Node.js
Linux Red Hat
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 5.8
Exploitation Probability (EPSS) N/A
Affected packages and libraries
nodejs:20::nodejs-nodemon
nodejs:20::v8-13.6-devel
Sources
NVD
Alpine 3.21 Severity HIGH Has Fix Added at: Apr 06, 2026
Alpine 3.22, 3.23, edge Severity
Wiz
CVE-2026-21717 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.9
CVE-2026-21717 [MEDIUM] CVE-2026-21717 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21717 :
Node.js vulnerability analysis and mitigation
A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process.
JSON.parse()
This vulnerability affects 20.x, 22.x, 24.x, and 25.x .
Source : NVD
## 5.9
Score
Published March 30, 2026
Severity MEDIUM
CNA Score 5.9
Affected Technologies
Node.js
Linux Red Hat
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 7.4
Exploitation Probability (EPSS) N/A
Affected packages and librari
Wiz
CVE-2025-55130 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 9.1
CVE-2025-55130 [CRITICAL] CVE-2025-55130 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-55130 :
Node.js vulnerability analysis and mitigation
--allow-fs-read
--allow-fs-write
Source : NVD
## 9.1
Score
Published January 20, 2026
Severity CRITICAL
CNA Score 7.1
Affected Technologies
Node.js
Rocky Linux
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 3
Exploitation Probability (EPSS) N/A
Affected packages and libraries
nodejs:20::npm
nodejs20-devel
Sources
AlmaLinux 8 Severity HIGH Has Fix Added at: Feb 15, 2026
AlmaLinux 9 Severity HIGH Has Fix Added at: Feb 19, 2026
Alpine 3.21 Severity CRITICAL Has Fix Added at: Apr 06, 2026
Alpine 3.22 Severity CRITICAL Has Fix Added at: Jan 23, 2026
Alpine 3.23, edge Severity CRITICAL Has Fix Added at: Jan 18, 2
Wiz
CVE-2025-59464 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
CVE-2025-59464 [HIGH] CVE-2025-59464 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-59464 :
Node.js vulnerability analysis and mitigation
X.509
socket.getPeerCertificate(true)
Source : NVD
## 7.5
Score
Published January 20, 2026
Severity HIGH
CNA Score 6.5
Affected Technologies
Node.js
Linux Fedora
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 16.4
Exploitation Probability (EPSS) 0.1
Affected packages and libraries
nodejs:24::npm
nodejs20-libs-debuginfo
Sources
Chainguard Has Fix Added at: Feb 02, 2026
Debian 11, 12, 13, 14 No Fix Added at: Jan 14, 2026
Echo No Fix Added at: Jan 14, 2026
MinimOS Severity HIGH Has Fix Added at: Jan 23, 2026
Red Hat 8, 9, 10 Severity MEDIUM No Fix Added at: Jan 21, 2026
Linux Severity HIGH Has Fix Added at: Ja
Wiz
CVE-2026-21716 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.9
CVE-2026-21716 [MEDIUM] CVE-2026-21716 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21716 :
Node.js vulnerability analysis and mitigation
FileHandle.chmod()
FileHandle.chown()
fs.fchmod()
fs.fchown()
--permission
--allow-fs-write
FileHandle
--allow-fs-write
Source : NVD
## 3.3
Score
Published March 30, 2026
Severity LOW
CNA Score 3.3
Affected Technologies
Node.js
Linux Red Hat
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 0.2
Exploitation Probability (EPSS) N/A
Affected packages and libraries
nodejs:20::npm
nodejs:22::nodejs-full-i18n
Sources
NVD
Alpine 3.21 Severity LOW Has Fix Added at: Apr 06, 2026
Alpine 3.22, 3.23, edge Severity LOW Has Fix Added at: Mar 26, 2026
Debian 11, 12 Severity LOW No Fix Added at: Mar 25, 2026
Debian 13, 1
Wiz
CVE-2026-21715 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.9
CVE-2026-21715 [MEDIUM] CVE-2026-21715 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21715 :
Node.js vulnerability analysis and mitigation
fs.realpathSync.native()
--permission
--allow-fs-read
fs.realpathSync.native()
--allow-fs-read
Source : NVD
## 3.3
Score
Published March 30, 2026
Severity LOW
CNA Score 3.3
Affected Technologies
Node.js
Linux Red Hat
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 0.2
Exploitation Probability (EPSS) N/A
Affected packages and libraries
nodejs:22::v8-13.6-devel
nodejs:24::nodejs-nodemon
Sources
NVD
Alpine 3.21 Severity LOW Has Fix Added at: Apr 06, 2026
Alpine 3.22, 3.23, edge Severity LOW Has Fix Added at: Mar 26, 2026
Debian 11, 12 Severity LOW No Fix Added at: Mar 25, 2026
Debian 13, 14 Severity LOW Has F
Wiz
CVE-2026-21713 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.9
CVE-2026-21713 [MEDIUM] CVE-2026-21713 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21713 :
Node.js vulnerability analysis and mitigation
A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior could be exploited as a timing oracle to infer HMAC values.
Node.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this is an oversight rather than an intentional design decision.
This vulnerability affects 20.x, 22.x, 24.x, and 25.x .
Source : NVD
## 5.9
Score
Published March 30, 2026
Severity MEDIUM
CNA Score 5.9
Affected Technologies
Node.js
Linux Red Hat
Has Public Ex
Wiz
CVE-2025-69418 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 4.0
CVE-2025-69418 [MEDIUM] CVE-2025-69418 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-69418 :
Node.js vulnerability analysis and mitigation
Issue summary: When using the low-level OCB API directly with AES-NI or
other hardware-accelerated code paths, inputs whose length is not a multiple
of 16 bytes can leave the final partial block unencrypted and unauthenticated.
Impact summary: The trailing 1-15 bytes of a message may be exposed in
cleartext on encryption and are not covered by the authentication tag,
allowing an attacker to read or tamper with those bytes without detection.
The low-level OCB encrypt and decrypt routines in the hardware-accelerated
stream path process full 16-byte blocks but do not advance the input/output
pointers. The subsequent tail-handling code then operates on the original
base pointers, effectively reprocessing the beginning of the
Wiz
CVE-2026-21714 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.9
CVE-2026-21714 [MEDIUM] CVE-2026-21714 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21714 :
Node.js vulnerability analysis and mitigation
A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up.
This vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.
Source : NVD
## 5.3
Score
Published March 30, 2026
Severity MEDIUM
CNA Score 5.3
Affected Technologies
Node.js
Linux Red Hat
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 3.4
Exploitation Probability (EPSS) N/A
Affected packages and libraries
nodejs24-devel
nodejs-de
Wiz
CVE-2026-21636 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 10.0
CVE-2026-21636 [CRITICAL] CVE-2026-21636 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21636 :
Node.js vulnerability analysis and mitigation
--permission
--allow-net
The issue affects users of the Node.js permission model on version v25.
--allow-net
Source : NVD
## 10
Score
Published January 20, 2026
Severity CRITICAL
CNA Score 5.8
Affected Technologies
Node.js
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 6.3
Exploitation Probability (EPSS) N/A
Affected packages and libraries
nodejs-20
nodejs-22
Sources
Chainguard Has Fix Added at: Feb 02, 2026
Debian 13 Severity CRITICAL Has Fix Added at: Jan 19, 2026
MinimOS Severity CRITICAL Has Fix Added at: Jan 23, 2026
Linux Severity CRITICAL Has Fix Added at: Jan 22, 2026
Windows Severity CRITICAL Has F
Wiz
CVE-2025-55132 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.3
CVE-2025-55132 [MEDIUM] CVE-2025-55132 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-55132 :
Node.js vulnerability analysis and mitigation
futimes()
utimes()
futimes()
Source : NVD
## 5.3
Score
Published January 20, 2026
Severity MEDIUM
CNA Score 2.8
Affected Technologies
Node.js
Rocky Linux
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 1.1
Exploitation Probability (EPSS) N/A
Affected packages and libraries
nodejs24-debuginfo
v8-13.6-devel
Sources
AlmaLinux 8 Severity HIGH Has Fix Added at: Feb 15, 2026
AlmaLinux 9 Severity HIGH Has Fix Added at: Feb 19, 2026
Alpine 3.21 Severity MEDIUM Has Fix Added at: Apr 06, 2026
Alpine 3.22 Severity MEDIUM Has Fix Added at: Jan 23, 2026
Alpine 3.23, edge Severity MEDIUM Has Fix Added at: Jan 18, 2026
C
Wiz
CVE-2026-21712 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.7
CVE-2026-21712 [MEDIUM] CVE-2026-21712 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21712 :
Node.js vulnerability analysis and mitigation
url.format()
Source : NVD
## 5.7
Score
Published March 30, 2026
Severity MEDIUM
CNA Score 5.7
Affected Technologies
Node.js
Linux Red Hat
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 2.8
Exploitation Probability (EPSS) N/A
Affected packages and libraries
nodejs-npm
nodejs:20::nodejs-devel
Sources
NVD
Alpine 3.23, edge Severity MEDIUM Has Fix Added at: Mar 26, 2026
Debian 11, 12, 13, 14 No Fix Added at: Mar 25, 2026
Echo No Fix Added at: Mar 25, 2026
MinimOS Severity MEDIUM Has Fix Added at: Apr 02, 2026
Red Hat 8, 9, 10 Severity MEDIUM No Fix Added at: Apr 02, 2026
Linux Severity MEDIUM Has Fix Added at:
Wiz
CVE-2026-21711 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.3
CVE-2026-21711 [MEDIUM] CVE-2026-21711 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21711 :
Node.js vulnerability analysis and mitigation
A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them.
--permission
--allow-net
--allow-net
--allow-net
Source : NVD
## 5.3
Score
Published March 30, 2026
Severity MEDIUM
CNA Score 5.3
Affected Technologies
Node.js
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 0.1
Exploitation Probability (EPSS) N/A
Affected packages and libraries
nodejs-25
cpe:2.3:a:nodejs:node.js
Sources
NVD
MinimOS Severity MEDIUM Has Fix Added at: Apr 02, 2026
Linux Severity MEDIUM Has Fix
Bugzilla
CVE-2026-21715 nodejs22: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions [fedora-all]
bugzilla·2026-03-31·CVSS 3.3
CVE-2026-21715 [LOW] CVE-2026-21715 nodejs22: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions [fedora-all]
CVE-2026-21715 nodejs22: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-2026-3b76d8047d (nodejs22-22.22.2-3.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-3b76d8047d
Bugzilla
CVE-2026-21715 nodejs20: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions [fedora-all]
bugzilla·2026-03-31·CVSS 3.3
CVE-2026-21715 [LOW] CVE-2026-21715 nodejs20: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions [fedora-all]
CVE-2026-21715 nodejs20: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-2026-9dc3a61ad8 (nodejs20-20.20.2-3.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-9dc3a61ad8
---
FEDORA-2026-c99f9dc3b1 (nodejs20-20.20.2-3.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-c99f9dc3b1
---
FEDORA-2026-c99f9dc3b1 has been pushed to the Fedora 44 testing repository.
Soon you'll be
Bugzilla
CVE-2026-21715 Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions
bugzilla·2026-03-30·CVSS 3.3
CVE-2026-21715 [LOW] CVE-2026-21715 Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions
CVE-2026-21715 Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them.
As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.
This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-read` is intentionally restricted.
Discussion:
This issue has been addressed in the following products:
Red Hat
2026-03-30
Published