Executive brief
Node.js is a popular runtime environment used to build and run server-side applications. A security flaw in its Permission Model allows an attacker to modify file metadata (such as timestamps) even when the system is configured to only allow read access to those files. While this does not allow an attacker to change the actual content of the files, it could be used to bypass certain security audits or interfere with backup and synchronization processes that rely on file timestamps.
Technical details
A vulnerability exists in the Node.js Permission Model where the FileHandle.utimes() method in the promises API fails to properly enforce filesystem restrictions. Specifically, an attacker with local access can modify file metadata (such as access and modification times) on paths that were explicitly restricted to read-only access using the --allow-fs-read flag. This bypass occurs because the utimes implementation does not correctly validate the path against the active permission set. The issue affects Node.js versions 22, 24, and 26. Patches have been released in versions 22.23.0, 24.17.0, and 26.3.1.
Affected products
- Node.js Node.js 22.x, 24.x, 26.x
Timeline
- 2026-06-18: patched: Security releases v22.23.0, v24.17.0, and v26.3.1 made available.
- 2026-06-26: disclosed: NVD publication date.