PT-2026-28319 · Node.Js+1 · Node.Js+1
Stif
·
Published
2026-01-01
·
Updated
2026-04-21
·
CVE-2026-21715
CVSS v3.1
3.3
Low
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Node.js versions 20.x through 25.x
Description
A flaw exists in the Node.js Permission Model's filesystem enforcement, specifically leaving the
fs.realpathSync.native() function without the necessary read permission checks. Comparable filesystem functions correctly enforce these checks. Consequently, code operating under the --permission flag with restricted --allow-fs-read can still utilize fs.realpathSync.native() to verify file existence, resolve symbolic link targets, and list filesystem paths outside of authorized directories. The vulnerable function is fs.realpathSync.native(). The affected API endpoint is not explicitly mentioned.Recommendations
Versions 20.x through 25.x are affected and require mitigation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Information Disclosure
Incorrect Permission
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Node.Js
Rocky Linux