An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched. As a result, code running under `--permission` with restricted `--allow-fs-write` can still use promise-based `FileHandle` methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions. This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-write` is intentionally restricted.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejsUpgrade nodejs-docsUpgrade nodejs-develUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade v8-13.6-develUpgrade nodejs-packagingUpgrade nodejs-packaging-bundler | Apr 16, 2026 | Apr 9, 2026 |
| Alpine Linux | — | Upgrade nodejs | Mar 31, 2026 | Mar 30, 2026 |
| Amazon_linux_2023 | — | Upgrade nodejs22-debuginfoUpgrade nodejs20Upgrade nodejs24-docsUpgrade nodejs24-debugsourceUpgrade nodejs24-develUpgrade nodejs20-npmUpgrade nodejs20-docsUpgrade nodejs22-full-i18nUpgrade nodejs24-npmUpgrade nodejs24-libs-debuginfoUpgrade nodejs20-debuginfoUpgrade nodejs20-libsUpgrade nodejs22-docsUpgrade v8-11.3-develUpgrade nodejs22-develUpgrade nodejs24Upgrade nodejs22-libs-debuginfoUpgrade nodejs20-full-i18nUpgrade nodejs20-libs-debuginfoUpgrade v8-13.6-develUpgrade nodejs20-debugsourceUpgrade nodejs22-npmUpgrade nodejs20-develUpgrade nodejs22-debugsourceUpgrade nodejs24-libsUpgrade nodejs24-debuginfoUpgrade v8-12.4-develUpgrade nodejs24-full-i18nUpgrade nodejs22Upgrade nodejs22-libs | Apr 14, 2026 | Mar 30, 2026 |
| Debian | — | Upgrade nodejs | Jul 23, 2026 | Jul 23, 2026 |
| Oracle_linux | — | Upgrade nodejs24-docsUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejs-libsUpgrade nodejs-develUpgrade v8-13.6-develUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs24Upgrade nodejs24-libsUpgrade nodejs24-full-i18nUpgrade nodejs24-develUpgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade npmUpgrade nodejs24-npm | Apr 22, 2026 | Mar 30, 2026 |
| Redhat_linux | — | Upgrade nodejs-libs-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejs-libsUpgrade nodejs24-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs24Upgrade nodejs24-debugsourceNo solution existsUpgrade v8-13.6-develUpgrade nodejs24-npmUpgrade nodejs-full-i18nUpgrade nodejs24-develUpgrade npmUpgrade nodejs-debuginfoUpgrade nodejs24-full-i18nUpgrade nodejs24-libsUpgrade nodejs24-docsUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs24-libs-debuginfo | Apr 13, 2026 | Mar 30, 2026 |
| Rocky_linux | — | Upgrade nodejs24-full-i18nUpgrade nodejs24-develUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs24-libs-debuginfoUpgrade nodejs24-libsUpgrade nodejs-libsUpgrade nodejs24-debuginfoUpgrade nodejs-debuginfoUpgrade v8-13.6-develUpgrade nodejs-develUpgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs24-debugsourceUpgrade nodejs24 | Apr 13, 2026 | Apr 10, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Mar 30, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub