Executive brief
A security flaw in Node.js allows an attacker to bypass filesystem restrictions when the experimental Permission Model is enabled. By exploiting how the system handles file path boundaries, a user who is granted access to one specific folder could potentially read or write files in unauthorized locations. This could lead to the exposure of sensitive data or the modification of critical system files.
Technical details
A vulnerability exists in the Node.js Permission Model (enabled via the --permission flag) due to improper boundary handling in the radix-tree prefix matching logic. An attacker with existing low-privileged access to a permitted path can craft requests that traverse beyond the intended filesystem allowlist. This allows for unauthorized read and write access to files outside the restricted scope. The issue affects Node.js versions 22.x, 24.x, and 26.x, and has been addressed in security updates v22.23.2, v24.18.1, and v26.5.1.
Affected products
- Node.js Foundation Node.js 22.x, 24.x, 26.x
Timeline
- 2026-07-29: advisory: Node.js project security release announcement
- 2026-07-30: disclosed: NVD publication date