CVE-2026-21716
published 2026-03-30CVE-2026-21716: An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while…
PriorityP414low3.3CVSS 3.0
AVLACLPRLUINSUCNILAN
EPSS
0.16%
5.5th percentile
An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched.
As a result, code running under `--permission` with restricted `--allow-fs-write` can still use promise-based `FileHandle` methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions.
This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-write` is intentionally restricted.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | nodejs | < nodejs 22.22.2+dfsg+~cs22.19.15-1 (forky) | nodejs 22.22.2+dfsg+~cs22.19.15-1 (forky) |
| nodejs | nodejs | >= 0 < 22.22.2-r0 | 22.22.2-r0 |
| nodejs | nodejs | >= 0 < 22.22.2-r0 | 22.22.2-r0 |
| nodejs | nodejs | >= 0 < 24.14.1-r0 | 24.14.1-r0 |
| nodejs | nodejs | >= 0 < 20.19.2+dfsg-1+deb13u2 | 20.19.2+dfsg-1+deb13u2 |
| nodejs | nodejs | >= 0 < 22.22.2+dfsg+~cs22.19.15-1 | 22.22.2+dfsg+~cs22.19.15-1 |
CVSS provenance
nvdv3.03.3LOWCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
osv3.3LOW
vendor_debian3.3LOW
vendor_redhat3.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-22vj-v4r3-878v: An incomplete fix for CVE-2024-36137 leaves `FileHandle
ghsa_unreviewed·2026-03-30·CVSS 3.3
CVE-2026-21716 [LOW] CWE-862 GHSA-22vj-v4r3-878v: An incomplete fix for CVE-2024-36137 leaves `FileHandle
An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched.
As a result, code running under `--permission` with restricted `--allow-fs-write` can still use promise-based `FileHandle` methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions.
This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-write` is intentionally restricted.
OSV
CVE-2026-21716: An incomplete fix for CVE-2024-36137 leaves `FileHandle
osv·2026-03-30·CVSS 3.3
CVE-2026-21716 [LOW] CVE-2026-21716: An incomplete fix for CVE-2024-36137 leaves `FileHandle
An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched. As a result, code running under `--permission` with restricted `--allow-fs-write` can still use promise-based `FileHandle` methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions. This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-write` is intentionally restricted.
OSV
CVE-2026-21716: An incomplete fix for CVE-2024-36137 leaves `FileHandle
osv·2026-03-30·CVSS 3.3
CVE-2026-21716 [LOW] CVE-2026-21716: An incomplete fix for CVE-2024-36137 leaves `FileHandle
An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched.
As a result, code running under `--permission` with restricted `--allow-fs-write` can still use promise-based `FileHandle` methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions.
This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-write` is intentionally restricted.
Red Hat
nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix.
vendor_redhat·2026-03-30·CVSS 3.3
CVE-2026-21716 [LOW] CWE-279 nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix.
nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix.
An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched.
As a result, code running under `--permission` with restricted `--allow-fs-write` can still use promise-based `FileHandle` methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions.
This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-write` is intentionally restricted.
A flaw was found in Node.
Debian
CVE-2026-21716: nodejs - An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle...
vendor_debian·2026·CVSS 3.3
CVE-2026-21716 [LOW] CVE-2026-21716: nodejs - An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle...
An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched. As a result, code running under `--permission` with restricted `--allow-fs-write` can still use promise-based `FileHandle` methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions. This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-write` is intentionally restricted.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 22.22.2+dfsg+~cs22.19.15-1)
sid: resolved (fixed in 22.22.2+dfsg+~cs22.19.15-1)
trixie: r
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-21710 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
CVE-2026-21710 [HIGH] CVE-2026-21710 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21710 :
Node.js vulnerability analysis and mitigation
TypeError
__proto__
req.headersDistinct
dest["__proto__"]
Object.prototype
undefined
.push()
error
req.headersDistinct
try/catch
This vulnerability affects all Node.js HTTP servers on 20.x, 22.x, 24.x, and v25.x
Source : NVD
## 7.5
Score
Published March 30, 2026
Severity HIGH
CNA Score 7.5
Affected Technologies
Node.js
Linux Red Hat
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 5.8
Exploitation Probability (EPSS) N/A
Affected packages and libraries
nodejs:20::nodejs-nodemon
nodejs:20::v8-13.6-devel
Sources
NVD
Alpine 3.21 Severity HIGH Has Fix Added at: Apr 06, 2026
Alpine 3.22, 3.23, edge Severity
Wiz
CVE-2026-21717 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.9
CVE-2026-21717 [MEDIUM] CVE-2026-21717 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21717 :
Node.js vulnerability analysis and mitigation
A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process.
JSON.parse()
This vulnerability affects 20.x, 22.x, 24.x, and 25.x .
Source : NVD
## 5.9
Score
Published March 30, 2026
Severity MEDIUM
CNA Score 5.9
Affected Technologies
Node.js
Linux Red Hat
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 7.4
Exploitation Probability (EPSS) N/A
Affected packages and librari
Wiz
CVE-2025-55130 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 9.1
CVE-2025-55130 [CRITICAL] CVE-2025-55130 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-55130 :
Node.js vulnerability analysis and mitigation
--allow-fs-read
--allow-fs-write
Source : NVD
## 9.1
Score
Published January 20, 2026
Severity CRITICAL
CNA Score 7.1
Affected Technologies
Node.js
Rocky Linux
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 3
Exploitation Probability (EPSS) N/A
Affected packages and libraries
nodejs:20::npm
nodejs20-devel
Sources
AlmaLinux 8 Severity HIGH Has Fix Added at: Feb 15, 2026
AlmaLinux 9 Severity HIGH Has Fix Added at: Feb 19, 2026
Alpine 3.21 Severity CRITICAL Has Fix Added at: Apr 06, 2026
Alpine 3.22 Severity CRITICAL Has Fix Added at: Jan 23, 2026
Alpine 3.23, edge Severity CRITICAL Has Fix Added at: Jan 18, 2
Wiz
CVE-2025-59464 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
CVE-2025-59464 [HIGH] CVE-2025-59464 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-59464 :
Node.js vulnerability analysis and mitigation
X.509
socket.getPeerCertificate(true)
Source : NVD
## 7.5
Score
Published January 20, 2026
Severity HIGH
CNA Score 6.5
Affected Technologies
Node.js
Linux Fedora
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 16.4
Exploitation Probability (EPSS) 0.1
Affected packages and libraries
nodejs:24::npm
nodejs20-libs-debuginfo
Sources
Chainguard Has Fix Added at: Feb 02, 2026
Debian 11, 12, 13, 14 No Fix Added at: Jan 14, 2026
Echo No Fix Added at: Jan 14, 2026
MinimOS Severity HIGH Has Fix Added at: Jan 23, 2026
Red Hat 8, 9, 10 Severity MEDIUM No Fix Added at: Jan 21, 2026
Linux Severity HIGH Has Fix Added at: Ja
Wiz
CVE-2026-21716 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.9
CVE-2026-21716 [MEDIUM] CVE-2026-21716 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21716 :
Node.js vulnerability analysis and mitigation
FileHandle.chmod()
FileHandle.chown()
fs.fchmod()
fs.fchown()
--permission
--allow-fs-write
FileHandle
--allow-fs-write
Source : NVD
## 3.3
Score
Published March 30, 2026
Severity LOW
CNA Score 3.3
Affected Technologies
Node.js
Linux Red Hat
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 0.2
Exploitation Probability (EPSS) N/A
Affected packages and libraries
nodejs:20::npm
nodejs:22::nodejs-full-i18n
Sources
NVD
Alpine 3.21 Severity LOW Has Fix Added at: Apr 06, 2026
Alpine 3.22, 3.23, edge Severity LOW Has Fix Added at: Mar 26, 2026
Debian 11, 12 Severity LOW No Fix Added at: Mar 25, 2026
Debian 13, 1
Wiz
CVE-2026-21715 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.9
CVE-2026-21715 [MEDIUM] CVE-2026-21715 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21715 :
Node.js vulnerability analysis and mitigation
fs.realpathSync.native()
--permission
--allow-fs-read
fs.realpathSync.native()
--allow-fs-read
Source : NVD
## 3.3
Score
Published March 30, 2026
Severity LOW
CNA Score 3.3
Affected Technologies
Node.js
Linux Red Hat
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 0.2
Exploitation Probability (EPSS) N/A
Affected packages and libraries
nodejs:22::v8-13.6-devel
nodejs:24::nodejs-nodemon
Sources
NVD
Alpine 3.21 Severity LOW Has Fix Added at: Apr 06, 2026
Alpine 3.22, 3.23, edge Severity LOW Has Fix Added at: Mar 26, 2026
Debian 11, 12 Severity LOW No Fix Added at: Mar 25, 2026
Debian 13, 14 Severity LOW Has F
Wiz
CVE-2026-21713 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.9
CVE-2026-21713 [MEDIUM] CVE-2026-21713 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21713 :
Node.js vulnerability analysis and mitigation
A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior could be exploited as a timing oracle to infer HMAC values.
Node.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this is an oversight rather than an intentional design decision.
This vulnerability affects 20.x, 22.x, 24.x, and 25.x .
Source : NVD
## 5.9
Score
Published March 30, 2026
Severity MEDIUM
CNA Score 5.9
Affected Technologies
Node.js
Linux Red Hat
Has Public Ex
Wiz
CVE-2025-69418 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 4.0
CVE-2025-69418 [MEDIUM] CVE-2025-69418 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-69418 :
Node.js vulnerability analysis and mitigation
Issue summary: When using the low-level OCB API directly with AES-NI or
other hardware-accelerated code paths, inputs whose length is not a multiple
of 16 bytes can leave the final partial block unencrypted and unauthenticated.
Impact summary: The trailing 1-15 bytes of a message may be exposed in
cleartext on encryption and are not covered by the authentication tag,
allowing an attacker to read or tamper with those bytes without detection.
The low-level OCB encrypt and decrypt routines in the hardware-accelerated
stream path process full 16-byte blocks but do not advance the input/output
pointers. The subsequent tail-handling code then operates on the original
base pointers, effectively reprocessing the beginning of the
Wiz
CVE-2026-21714 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.9
CVE-2026-21714 [MEDIUM] CVE-2026-21714 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21714 :
Node.js vulnerability analysis and mitigation
A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up.
This vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.
Source : NVD
## 5.3
Score
Published March 30, 2026
Severity MEDIUM
CNA Score 5.3
Affected Technologies
Node.js
Linux Red Hat
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 3.4
Exploitation Probability (EPSS) N/A
Affected packages and libraries
nodejs24-devel
nodejs-de
Wiz
CVE-2026-21636 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 10.0
CVE-2026-21636 [CRITICAL] CVE-2026-21636 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21636 :
Node.js vulnerability analysis and mitigation
--permission
--allow-net
The issue affects users of the Node.js permission model on version v25.
--allow-net
Source : NVD
## 10
Score
Published January 20, 2026
Severity CRITICAL
CNA Score 5.8
Affected Technologies
Node.js
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 6.3
Exploitation Probability (EPSS) N/A
Affected packages and libraries
nodejs-20
nodejs-22
Sources
Chainguard Has Fix Added at: Feb 02, 2026
Debian 13 Severity CRITICAL Has Fix Added at: Jan 19, 2026
MinimOS Severity CRITICAL Has Fix Added at: Jan 23, 2026
Linux Severity CRITICAL Has Fix Added at: Jan 22, 2026
Windows Severity CRITICAL Has F
Wiz
CVE-2025-55132 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.3
CVE-2025-55132 [MEDIUM] CVE-2025-55132 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-55132 :
Node.js vulnerability analysis and mitigation
futimes()
utimes()
futimes()
Source : NVD
## 5.3
Score
Published January 20, 2026
Severity MEDIUM
CNA Score 2.8
Affected Technologies
Node.js
Rocky Linux
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 1.1
Exploitation Probability (EPSS) N/A
Affected packages and libraries
nodejs24-debuginfo
v8-13.6-devel
Sources
AlmaLinux 8 Severity HIGH Has Fix Added at: Feb 15, 2026
AlmaLinux 9 Severity HIGH Has Fix Added at: Feb 19, 2026
Alpine 3.21 Severity MEDIUM Has Fix Added at: Apr 06, 2026
Alpine 3.22 Severity MEDIUM Has Fix Added at: Jan 23, 2026
Alpine 3.23, edge Severity MEDIUM Has Fix Added at: Jan 18, 2026
C
Wiz
CVE-2026-21712 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.7
CVE-2026-21712 [MEDIUM] CVE-2026-21712 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21712 :
Node.js vulnerability analysis and mitigation
url.format()
Source : NVD
## 5.7
Score
Published March 30, 2026
Severity MEDIUM
CNA Score 5.7
Affected Technologies
Node.js
Linux Red Hat
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 2.8
Exploitation Probability (EPSS) N/A
Affected packages and libraries
nodejs-npm
nodejs:20::nodejs-devel
Sources
NVD
Alpine 3.23, edge Severity MEDIUM Has Fix Added at: Mar 26, 2026
Debian 11, 12, 13, 14 No Fix Added at: Mar 25, 2026
Echo No Fix Added at: Mar 25, 2026
MinimOS Severity MEDIUM Has Fix Added at: Apr 02, 2026
Red Hat 8, 9, 10 Severity MEDIUM No Fix Added at: Apr 02, 2026
Linux Severity MEDIUM Has Fix Added at:
Wiz
CVE-2026-21711 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.3
CVE-2026-21711 [MEDIUM] CVE-2026-21711 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21711 :
Node.js vulnerability analysis and mitigation
A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them.
--permission
--allow-net
--allow-net
--allow-net
Source : NVD
## 5.3
Score
Published March 30, 2026
Severity MEDIUM
CNA Score 5.3
Affected Technologies
Node.js
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 0.1
Exploitation Probability (EPSS) N/A
Affected packages and libraries
nodejs-25
cpe:2.3:a:nodejs:node.js
Sources
NVD
MinimOS Severity MEDIUM Has Fix Added at: Apr 02, 2026
Linux Severity MEDIUM Has Fix
Bugzilla
CVE-2026-21716 nodejs22: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. [fedora-all]
bugzilla·2026-03-31·CVSS 3.3
CVE-2026-21716 [LOW] CVE-2026-21716 nodejs22: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. [fedora-all]
CVE-2026-21716 nodejs22: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-2026-3b76d8047d (nodejs22-22.22.2-3.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-3b76d8047d
Bugzilla
CVE-2026-21716 nodejs20: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. [fedora-all]
bugzilla·2026-03-31·CVSS 3.3
CVE-2026-21716 [LOW] CVE-2026-21716 nodejs20: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. [fedora-all]
CVE-2026-21716 nodejs20: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-2026-9dc3a61ad8 (nodejs20-20.20.2-3.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-9dc3a61ad8
---
FEDORA-2026-c99f9dc3b1 (nodejs20-20.20.2-3.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-c99f9dc3b1
---
FEDORA-2026-c99f9dc3b1 has been pushed to the Fedora 44 testing reposito
Bugzilla
CVE-2026-21716 nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix.
bugzilla·2026-03-30·CVSS 3.3
CVE-2026-21716 [LOW] CVE-2026-21716 nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix.
CVE-2026-21716 nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix.
An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched.
As a result, code running under `--permission` with restricted `--allow-fs-write` can still use promise-based `FileHandle` methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions.
This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-write` is intentionally restricted.
Discuss
2026-03-30
Published