A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them. As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories. This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-read` is intentionally restricted.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-develUpgrade v8-13.6-develUpgrade nodejs-docsUpgrade nodejs-packaging-bundlerUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade nodejs-libsUpgrade nodejsUpgrade nodejs-packaging | Apr 16, 2026 | Apr 9, 2026 |
| Alpine Linux | — | Upgrade nodejs | Mar 31, 2026 | Mar 30, 2026 |
| Amazon_linux_2023 | — | Upgrade v8-11.3-develUpgrade nodejs24-develUpgrade nodejs20-npmUpgrade nodejs22-libs-debuginfoUpgrade nodejs22-full-i18nUpgrade nodejs20-libs-debuginfoUpgrade v8-13.6-develUpgrade nodejs22Upgrade nodejs24-npmUpgrade nodejs22-debuginfoUpgrade nodejs22-debugsourceUpgrade nodejs24-libsUpgrade nodejs20-full-i18nUpgrade nodejs20-debugsourceUpgrade nodejs20Upgrade nodejs22-libsUpgrade nodejs22-develUpgrade nodejs24-full-i18nUpgrade nodejs20-docsUpgrade nodejs24-debuginfoUpgrade nodejs24Upgrade nodejs20-develUpgrade nodejs22-docsUpgrade nodejs20-libsUpgrade nodejs22-npmUpgrade nodejs24-libs-debuginfoUpgrade nodejs24-debugsourceUpgrade v8-12.4-develUpgrade nodejs24-docsUpgrade nodejs20-debuginfo | Apr 14, 2026 | Mar 30, 2026 |
| Debian | — | Upgrade nodejs | Jul 23, 2026 | Jul 23, 2026 |
| Oracle_linux | — | Upgrade nodejs-docsUpgrade v8-13.6-develUpgrade nodejs24Upgrade nodejsUpgrade nodejs-develUpgrade nodejs-full-i18nUpgrade nodejs24-full-i18nUpgrade nodejs-packagingUpgrade nodejs-libsUpgrade nodejs24-develUpgrade npmUpgrade nodejs24-docsUpgrade nodejs-nodemonUpgrade nodejs24-libsUpgrade nodejs24-npmUpgrade nodejs-packaging-bundler | Apr 22, 2026 | Mar 30, 2026 |
| Redhat_linux | — | Upgrade nodejs-libsUpgrade nodejs24-develUpgrade nodejs24-npmNo solution existsUpgrade nodejs-full-i18nUpgrade nodejs24-docsUpgrade v8-13.6-develUpgrade npmUpgrade nodejsUpgrade nodejs24-libs-debuginfoUpgrade nodejs-develUpgrade nodejs24-libsUpgrade nodejs24Upgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejs-libs-debuginfoUpgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade nodejs24-debugsourceUpgrade nodejs24-full-i18nUpgrade nodejs24-debuginfoUpgrade nodejs-nodemon | Apr 13, 2026 | Mar 30, 2026 |
| Rocky_linux | — | Upgrade v8-13.6-develUpgrade nodejs24-libsUpgrade nodejs24-full-i18nUpgrade nodejs24-develUpgrade nodejs-develUpgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs24-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs24Upgrade nodejs-libsUpgrade nodejs24-debuginfoUpgrade nodejs24-libs-debuginfoUpgrade nodejs-full-i18n | Apr 13, 2026 | Apr 10, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Mar 30, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub