A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them. As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories. This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-read` is intentionally restricted.
CVSS Details
- CVSS 3.0 Base Score: 3.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packaging-bundlerUpgrade nodejs-docsUpgrade nodejs-develUpgrade npmUpgrade v8-13.6-develUpgrade nodejs-nodemonUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-packaging | Apr 16, 2026 | Apr 9, 2026 |
| Alpine Linux | — | Upgrade nodejs | Mar 31, 2026 | Mar 30, 2026 |
| Amazon_linux_2023 | — | Upgrade v8-11.3-develUpgrade v8-13.6-develUpgrade nodejs22Upgrade nodejs22-libs-debuginfoUpgrade nodejs24-npmUpgrade nodejs22-debuginfoUpgrade nodejs20-npmUpgrade nodejs22-full-i18nUpgrade nodejs20-libs-debuginfoUpgrade nodejs24-develUpgrade nodejs22-debugsourceUpgrade nodejs24-libs-debuginfoUpgrade nodejs24-full-i18nUpgrade nodejs22-develUpgrade nodejs20Upgrade nodejs22-libsUpgrade nodejs20-debuginfoUpgrade nodejs22-npmUpgrade nodejs20-docsUpgrade nodejs24-debuginfoUpgrade nodejs24Upgrade nodejs20-develUpgrade nodejs24-libsUpgrade nodejs20-debugsourceUpgrade nodejs22-docsUpgrade nodejs20-full-i18nUpgrade nodejs20-libsUpgrade nodejs24-docsUpgrade v8-12.4-develUpgrade nodejs24-debugsource | Apr 14, 2026 | Mar 30, 2026 |
| Debian | — | Upgrade nodejs | Jul 23, 2026 | Jul 23, 2026 |
| Oracle_linux | — | Upgrade nodejsUpgrade npmUpgrade nodejs24-docsUpgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade nodejs24-full-i18nUpgrade nodejs24-libsUpgrade nodejs24-npmUpgrade nodejs-libsUpgrade nodejs24-develUpgrade v8-13.6-develUpgrade nodejs24Upgrade nodejs-docsUpgrade nodejs-devel | Apr 22, 2026 | Mar 30, 2026 |
| Redhat_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-packaging-bundlerUpgrade nodejs24-debugsourceUpgrade nodejs24-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs-packagingUpgrade nodejs24Upgrade nodejs-debugsourceUpgrade nodejs24-full-i18nUpgrade nodejs-libs-debuginfoUpgrade nodejs-libsUpgrade nodejs24-npmUpgrade nodejs24-libs-debuginfoUpgrade v8-13.6-develNo solution existsUpgrade nodejs-full-i18nUpgrade nodejs24-develUpgrade nodejsUpgrade npmUpgrade nodejs-develUpgrade nodejs24-docsUpgrade nodejs24-libs | Apr 13, 2026 | Mar 30, 2026 |
| Rocky_linux | — | Upgrade nodejs24-libs-debuginfoUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejs24-debuginfoUpgrade nodejs24-debugsourceUpgrade nodejs24-libsUpgrade nodejs-debuginfoUpgrade v8-13.6-develUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-develUpgrade nodejs24-develUpgrade nodejs24Upgrade nodejs24-full-i18nUpgrade nodejs-libs-debuginfo | Apr 13, 2026 | Apr 10, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Mar 30, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub