The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.from() to obtain a Buffer from the result of path.resolve(). By monkey-patching Buffer internals, namely, Buffer.prototype.utf8Write, the application can modify the result of path.resolve(), which leads to a path traversal vulnerability. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- CVSS 3.0 Base Score: 7.9
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade npmUpgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-full-i18n | Apr 11, 2024 | Feb 20, 2024 |
| Amazon_linux_2023 | — | Upgrade nodejs20-develUpgrade nodejs20-full-i18nUpgrade nodejs20-debugsourceUpgrade nodejs20-libs-debuginfoUpgrade nodejs20-debuginfoUpgrade nodejs20-npmUpgrade v8-11.3-develUpgrade nodejs20-libsUpgrade nodejs20-docsUpgrade nodejs20 | Feb 17, 2025 | Feb 19, 2024 |
| Freebsd | — | Upgrade node21Upgrade node16Upgrade node20Upgrade node18Upgrade node | Mar 2, 2024 | Mar 1, 2024 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 15, 2025 | Feb 20, 2024 |
| Oracle_linux | — | Upgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-nodemon | Apr 9, 2024 | Feb 19, 2024 |
| Redhat_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejsUpgrade npmUpgrade nodejs-docs | Apr 9, 2024 | Feb 20, 2024 |
| Rocky_linux | — | Upgrade nodejs-develUpgrade npmUpgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-debugsource | May 8, 2024 | Feb 20, 2024 |
| Suse | — | Upgrade nodejs20Upgrade corepack20Upgrade nodejs20-develUpgrade nodejs20-docsUpgrade npm20 | Feb 29, 2024 | Feb 20, 2024 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Feb 20, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 20, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub