{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21715", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "state": "PUBLISHED", "assignerShortName": "hackerone", "dateReserved": "2026-01-04T15:00:06.574Z", "datePublished": "2026-03-30T19:07:28.507Z", "dateUpdated": "2026-04-01T15:02:10.706Z"}, "containers": {"cna": {"descriptions": [{"lang": "en", "value": "A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them.\r\n\r\nAs a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.\r\n\r\nThis vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-read` is intentionally restricted."}], "affected": [{"defaultStatus": "unaffected", "vendor": "nodejs", "product": "node", "versions": [{"version": "20.20.1", "status": "affected", "lessThanOrEqual": "20.20.1", "versionType": "semver"}, {"version": "22.22.1", "status": "affected", "lessThanOrEqual": "22.22.1", "versionType": "semver"}, {"version": "24.14.0", "status": "affected", "lessThanOrEqual": "24.14.0", "versionType": "semver"}, {"version": "25.8.1", "status": "affected", "lessThanOrEqual": "25.8.1", "versionType": "semver"}, {"version": "4.0", "status": "affected", "lessThan": "4.*", "versionType": "semver"}, {"version": "5.0", "status": "affected", "lessThan": "5.*", "versionType": "semver"}, {"version": "6.0", "status": "affected", "lessThan": "6.*", "versionType": "semver"}, {"version": "7.0", "status": "affected", "lessThan": "7.*", "versionType": "semver"}, {"version": "8.0", "status": "affected", "lessThan": "8.*", "versionType": "semver"}, {"version": "9.0", "status": "affected", "lessThan": "9.*", "versionType": "semver"}, {"version": "10.0", "status": "affected", "lessThan": "10.*", "versionType": "semver"}, {"version": "11.0", "status": "affected", "lessThan": "11.*", "versionType": "semver"}, {"version": "12.0", "status": "affected", "lessThan": "12.*", "versionType": "semver"}, {"version": "13.0", "status": "affected", "lessThan": "13.*", "versionType": "semver"}, {"version": "14.0", "status": "affected", "lessThan": "14.*", "versionType": "semver"}, {"version": "15.0", "status": "affected", "lessThan": "15.*", "versionType": "semver"}, {"version": "16.0", "status": "affected", "lessThan": "16.*", "versionType": "semver"}, {"version": "17.0", "status": "affected", "lessThan": "17.*", "versionType": "semver"}, {"version": "18.0", "status": "affected", "lessThan": "18.*", "versionType": "semver"}, {"version": "19.0", "status": "affected", "lessThan": "19.*", "versionType": "semver"}]}], "references": [{"url": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases"}], "metrics": [{"cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 3.3, "baseSeverity": "LOW"}}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2026-03-30T19:07:28.507Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-732", "lang": "en", "description": "CWE-732 Incorrect Permission Assignment for Critical Resource"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-01T14:55:13.031405Z", "id": "CVE-2026-21715", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T15:02:10.706Z"}}]}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them.\r\n\r\nAs a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.\r\n\r\nThis vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-read` is intentionally restricted."}, {"lang": "es", "value": "Una falla en la aplicaci\u00f3n del modelo de permisos del sistema de archivos de Node.js deja a 'fs.realpathSync.native()' sin las comprobaciones de permisos de lectura requeridas, mientras que todas las funciones comparables del sistema de archivos las aplican correctamente.\n\nComo resultado, el c\u00f3digo que se ejecuta bajo '--permission' con '--allow-fs-read' restringido a\u00fan puede usar 'fs.realpathSync.native()' para verificar la existencia de archivos, resolver destinos de enlaces simb\u00f3licos y enumerar rutas del sistema de archivos fuera de los directorios permitidos.\n\nEsta vulnerabilidad afecta a los procesos 20.x, 22.x, 24.x y 25.x que utilizan el Modelo de Permisos donde '--allow-fs-read' est\u00e1 restringido intencionalmente."}], "id": "CVE-2026-21715", "lastModified": "2026-04-01T16:23:48.967", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "support@hackerone.com", "type": "Secondary"}]}, "published": "2026-03-30T20:16:19.703", "references": [{"source": "support@hackerone.com", "url": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases"}], "sourceIdentifier": "support@hackerone.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-732"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions", "id": "2453152", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453152"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-425", "details": ["A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them.\nAs a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.\nThis vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-read` is intentionally restricted.", "A flaw was found in Node.js. The Node.js Permission Model, intended to restrict filesystem access, does not properly enforce read permission checks for the `fs.realpathSync.native()` function. This vulnerability allows code operating under `--permission` with restricted `--allow-fs-read` flags to bypass security controls. Consequently, an attacker can use `fs.realpathSync.native()` to determine file existence, resolve symbolic link targets, and enumerate filesystem paths outside of permitted directories, leading to information disclosure."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-21715", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "nodejs22", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "nodejs24", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "nodejs:20/nodejs", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "nodejs:22/nodejs", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "nodejs:24/nodejs", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "nodejs:20/nodejs", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "nodejs:22/nodejs", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "nodejs:24/nodejs", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-03-30T19:07:28Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-21715\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-21715\nhttps://nodejs.org/en/blog/vulnerability/march-2026-security-releases"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[20.20.1,20.20.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[22.22.1,22.22.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[24.14.0,24.14.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[25.8.1,25.8.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0,5.0.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0,6.0.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.0,7.0.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.0,8.0.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.0,9.0.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.0,10.0.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[10.0,11.0.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[11.0,12.0.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.0,13.0.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.0,14.0.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[14.0,15.0.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[15.0,16.0.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[16.0,17.0.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[17.0,18.0.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[18.0,19.0.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[19.0,20.0.0)"}}], "enrichment": {"confidence": 92.0, "confidence_source": "matching", "scores": [{"score": 92.0, "source": "matching"}]}, "original": {"product": "node", "source": "cna", "vendor": "nodejs"}, "product": "nodejs", "vendor": "nodejs"}], "analysis": {"en": {"generated_at": "2026-04-02T21:44:13.111309+00:00", "value": {"mitigation_remediation": ["Update Node.js to the latest patch release for 20.x, 22.x, 24.x, and 25.x that addresses the fs.realpathSync.native() permission check issue.", "Verify that the --allow-fs-read flag is correctly configured for all processes that run with the Permission Model.", "If immediate patching is not feasible, avoid calling fs.realpathSync.native() from untrusted or external code to prevent information disclosure.", "Monitor application behavior and logs for attempts to resolve paths outside of intended directories, and consider applying additional application-layer controls to restrict filesystem enumeration."], "summary": {"action": "Apply Patch", "impact": "Information Disclosure"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Node.js versions 20.x, 22.x, 24.x, and 25.x when the Permission Model is enabled and --allow-fs-read is intentionally disabled. All processes running under these configurations that invoke fs.realpathSync.native() are susceptible.", "description_and_impact": "Node.js enforces a Permission Model that restricts file system access to processes running with the --allow-fs-read flag. However, the realpathSync.native() method is exempt from the required read permission checks, allowing local code running under restricted file system reads to verify the existence of files, resolve symlinks, and traverse paths outside the permitted directories. This flaw can reveal the structure of the file system, sensitive file names, and other details that should remain hidden, resulting in information disclosure.", "risk_and_exploitability": "The CVSS score of 3.3 indicates a low overall severity, and the EPSS score of less than 1% suggests that exploitation is unlikely at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires code execution within a Node.js process that has been restricted by the Permission Model, implying an attacker would need local access to inject or run malicious JavaScript. The attack vector is inferred to be local, as the flaw does not expose a network-facing entry point."}}}}, "created": "2026-03-30T20:55:12.132860+00:00", "updated": "2026-04-03T09:38:06.833824+00:00", "vendors": ["nodejs", "nodejs$PRODUCT$nodejs"]}