A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
- CVSS 3.0 Base Score: 7.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-libsUpgrade v8-13.6-develUpgrade nodejs-develUpgrade npmUpgrade nodejsUpgrade nodejs-nodemonUpgrade v8-12.4-develUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade nodejs-full-i18n | Feb 16, 2026 | Feb 10, 2026 |
| Alpine Linux | — | Upgrade nodejs | Jan 21, 2026 | Jan 20, 2026 |
| Amazon_linux_2023 | — | Upgrade nodejs22-debuginfoUpgrade nodejs22-docsUpgrade nodejs20-debugsourceUpgrade nodejs20-full-i18nUpgrade nodejs20-develUpgrade nodejs24Upgrade nodejs24-debuginfoUpgrade v8-13.6-develUpgrade nodejs24-libsUpgrade nodejs22-libs-debuginfoUpgrade nodejs22Upgrade nodejs20-libs-debuginfoUpgrade nodejs22-full-i18nUpgrade nodejs24-debugsourceUpgrade nodejs24-full-i18nUpgrade nodejs22-debugsourceUpgrade nodejs22-libsUpgrade nodejs22-develUpgrade nodejs20-docsUpgrade nodejs20Upgrade nodejs24-docsUpgrade v8-11.3-develUpgrade nodejs24-npmUpgrade nodejs20-libsUpgrade nodejs20-debuginfoUpgrade nodejs22-npmUpgrade nodejs20-npmUpgrade nodejs24-libs-debuginfoUpgrade nodejs24-develUpgrade v8-12.4-devel | Feb 10, 2026 | Jan 20, 2026 |
| Debian | — | Upgrade nodejs | Jul 23, 2026 | Jul 23, 2026 |
| Oracle_linux | — | Upgrade nodejsUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs24Upgrade v8-12.4-develUpgrade nodejs-libsUpgrade nodejs-packagingUpgrade v8-13.6-develUpgrade nodejs-docsUpgrade nodejs24-libsUpgrade nodejs24-develUpgrade npmUpgrade nodejs-npmUpgrade nodejs24-docsUpgrade nodejs-packaging-bundlerUpgrade nodejs24-npmUpgrade nodejs24-full-i18nUpgrade nodejs-full-i18n | Feb 9, 2026 | Jan 20, 2026 |
| Redhat_linux | — | Upgrade nodejs-libs-debuginfoUpgrade nodejs-docsUpgrade nodejs24-docsUpgrade nodejsUpgrade nodejs24-develUpgrade nodejs-nodemonUpgrade nodejs-libsUpgrade nodejs22-debuginfoUpgrade v8-13.6-develUpgrade nodejs-develUpgrade nodejs-npmUpgrade nodejs-full-i18nUpgrade nodejs24-npmUpgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade nodejs24-libsUpgrade nodejs24-libs-debuginfoUpgrade nodejs24-debugsourceUpgrade nodejs24-debuginfoUpgrade nodejs24Upgrade nodejs22-debugsourceUpgrade v8-12.4-develUpgrade nodejs-debugsourceUpgrade nodejs24-full-i18n | Feb 6, 2026 | Jan 20, 2026 |
| Rocky_linux | — | Upgrade npmUpgrade v8-13.6-develUpgrade nodejs-libs-debuginfoUpgrade nodejs24Upgrade nodejs-libsUpgrade nodejs-npmUpgrade nodejs-develUpgrade nodejs22-debugsourceUpgrade nodejs24-develUpgrade nodejsUpgrade nodejs22-debuginfoUpgrade nodejs24-libsUpgrade nodejs-debugsourceUpgrade nodejs24-full-i18nUpgrade nodejs24-debuginfoUpgrade nodejs24-libs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs24-debugsourceUpgrade nodejs-debuginfoUpgrade v8-12.4-devel | Feb 9, 2026 | Feb 6, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Jan 20, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub