Description
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**.
CVSS breakdown
CVSS 3.0
Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
None
Affected products
- nodejs / node22.23.1 – 22.23.1
- nodejs / node24.18.0 – 24.18.0
- nodejs / node26.5.0 – 26.5.0
- nodejs / node.js22.0 – 22.23.1
Updated 7m ago · 8 sources