Executive brief
A security flaw has been identified in Node.js, a widely used platform for running server-side applications. The issue involves a failure in the system's permission model, which is designed to restrict where the application can write files. An attacker with local access could exploit this to write or overwrite files in locations that should be protected, potentially leading to the exposure of sensitive information or a bypass of security boundaries.
Technical details
A vulnerability classified as Improper Access Control (CWE-284) exists in the Node.js Permission Model. The root cause is a failure to properly enforce file system write restrictions during the execution of the 'process.report' function. This allows an attacker with local access to write or overwrite files outside of the paths explicitly permitted by the '--allow-fs-write' flag. The exploit requires local access with low privileges and no user interaction. This can result in a bypass of intended security boundaries and potential confidentiality impacts. The issue affects Node.js versions 22.x, 24.x, and 26.x.
Affected products
- Node.js Foundation Node.js 22.x, 24.x, 26.x
Timeline
- 2026-07-31: disclosed
- 2026-07-31: advisory