A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`.
As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.
This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
CVSS Details
- CVSS 3.0 Base Score: 3.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nodejs-currentUpgrade nodejs | Oct 28, 2026 | Oct 23, 2026 |
| Amazon_linux_2023 | — | Upgrade nodejs24-full-i18nUpgrade nodejs22-docsUpgrade nodejs24-docsUpgrade nodejs22-libsUpgrade nodejs24-debugsourceUpgrade nodejs22-npmUpgrade nodejs22-develUpgrade nodejs22-debugsourceUpgrade nodejs24-libsUpgrade nodejs24-libs-debuginfoUpgrade nodejs24-npmUpgrade v8-12.4-develUpgrade v8-13.6-develUpgrade nodejs22Upgrade nodejs24-debuginfoUpgrade nodejs24Upgrade nodejs22-debuginfoUpgrade nodejs22-libs-debuginfoUpgrade nodejs22-full-i18nUpgrade nodejs24-devel | Oct 28, 2026 | Oct 23, 2026 |
| Nodejs | — | Upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1 or later | Oct 28, 2026 | Oct 23, 2026 |
| Redhat_linux | — | No solution exists | Oct 27, 2026 | Oct 23, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub