Executive brief
Node.js Permission Model is a security feature that restricts file system access when applications run with `--permission` and `--allow-fs-read` flags. This vulnerability allows code to bypass those restrictions by using `fs.realpathSync.native()` to read file metadata, resolve symlinks, and enumerate filesystem paths outside permitted directories. An attacker could determine if files exist and their locations even when restricted by the permission model.
Technical details
The vulnerability is a missing permission check in Node.js Permission Model filesystem enforcement. The `fs.realpathSync.native()` function lacks the read permission validation that all comparable filesystem functions enforce when `--allow-fs-read` is restricted. An attacker can call this function to check file existence, resolve symlink targets, and enumerate filesystem paths outside of allowed directories. The attack is network-adjacent or local, requiring code execution within the restricted Node.js process. Patches are available in Node.js 20.x, 22.x, 24.x, and 25.x security releases (March 2026).
Affected products
- OpenJS Foundation Node.js 20.x, 22.x, 24.x, 25.x
Timeline
- 2026-03-24: disclosed: Security release published
- 2026-03-30: advisory: CVE-2026-21715 published on NVD