PT-2026-28320 · Node.Js+1 · Node.Js+1

Wooseokdotkim · Published 2026-01-01 · Updated 2026-04-21 · CVE-2026-21716

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Node.js versions 20.x through 25.x

Description An incomplete fix allows bypassing of intended write restrictions when using the Permission Model with restricted --allow-fs-write. Specifically, the FileHandle.chmod() and FileHandle.chown() methods within the promises API lack the necessary permission checks, while their callback-based counterparts (fs.fchmod(), fs.fchown()) were patched correctly. This allows code running with restricted permissions to modify file permissions and ownership on already-open file descriptors. The vulnerable API endpoints are FileHandle.chmod() and FileHandle.chown(). The vulnerable variables are file permissions and ownership.

Recommendations Update to a version beyond 25.x when available.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

CWE-769

Related Identifiers

ALSA-2026:7350

ALSA-2026:7670

ALSA-2026:7675

BDU:2026-04837

BIT-NODE-2026-21716

BIT-NODE-MIN-2026-21716

CVE-2026-21716

MGASA-2026-0071

OESA-2026-1951

OESA-2026-1952

OESA-2026-1953

OESA-2026-1954

OPENSUSE-SU-2026:10504-1

OPENSUSE-SU-2026:20519-1

RHSA-2026:6402

RHSA-2026:6431

RHSA-2026:7350

RHSA-2026:7386

RHSA-2026:7387

RHSA-2026:7670

RHSA-2026:7675

SUSE-SU-2026:1299-1

SUSE-SU-2026:1363-1

SUSE-SU-2026:1371-1

SUSE-SU-2026:1478-1

SUSE-SU-2026:1509-1

SUSE-SU-2026:21181-1

Affected Products

Node.Js

Rocky Linux

References · 121

• https://osv.dev/vulnerability/DEBIAN-CVE-2026-21716 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21715 · Security Note
• https://osv.dev/vulnerability/OESA-2026-1951 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2026-0071.html · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:1509-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2026-21716 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21714 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-21713 · Security Note
• https://linux.oracle.com/errata/ELSA-2026-7670.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1478-1 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-node-2026-21716 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-21716 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1371-1 · Vendor Advisory
• https://errata.almalinux.org/10/ALSA-2026-7675.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20519-1 · Vendor Advisory