Public mode

No access to your tenant or devices. Every item links to its source. What this means

Sources need attention Customize Public modeDiscuss ChangeIntel on Discord

node · Vulnerability

CVSS 3.0 3.3 LOWCheck source for fixed versionsKEV status unknown

cve-program · CVE-2026-21715

Published

A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them. As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories. This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-read` is intentionally restricted.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-21715

Published

node

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "vendor": "nodejs",
                    "product": "node",
                    "versions": [
                        {
                            "version": "20.20.1",
                            "status": "affected",
                            "lessThanOrEqual": "20.20.1",
                            "versionType": "semver"
                        },
                        {
                            "version": "22.22.1",
                            "status": "affected",
                            "lessThanOrEqual": "22.22.1",
                            "versionType": "semver"
                        },
                        {
                            "version": "24.14.0",
                            "status": "affected",
                            "lessThanOrEqual": "24.14.0",
                            "versionType": "semver"
                        },
                        {
                            "version": "25.8.1",
                            "status": "affected",
                            "lessThanOrEqual": "25.8.1",
                            "versionType": "semver"
                        },
                        {
                            "version": "4.0",
                            "status": "affected",
                            "lessThan": "4.*",
                            "versionType": "semver"
                        },
                        {
                            "version": "5.0",
                            "status": "affected",
                            "lessThan": "5.*",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.0",
                            "status": "affected",
                            "lessThan": "6.*",
                            "versionType": "semver"
                        },
                        {
                            "version": "7.0",
                            "status": "affected",
                            "lessThan": "7.*",
                            "versionType": "semver"
                        },
                        {
                            "version": "8.0",
                            "status": "affected",
                            "lessThan": "8.*",
                            "versionType": "semver"
                        },
                        {
                            "version": "9.0",
                            "status": "affected",
                            "lessThan": "9.*",
                            "versionType": "semver"
                        },
                        {
                            "version": "10.0",
                            "status": "affected",
                            "lessThan": "10.*",
                            "versionType": "semver"
                        },
                        {
                            "version": "11.0",
                            "status": "affected",
                            "lessThan": "11.*",
                            "versionType": "semver"
                        },
                        {
                            "version": "12.0",
                            "status": "affected",
                            "lessThan": "12.*",
                            "versionType": "semver"
                        },
                        {
                            "version": "13.0",
                            "status": "affected",
                            "lessThan": "13.*",
                            "versionType": "semver"
                        },
                        {
                            "version": "14.0",
                            "status": "affected",
                            "lessThan": "14.*",
                            "versionType": "semver"
                        },
                        {
                            "version": "15.0",
                            "status": "affected",
                            "lessThan": "15.*",
                            "versionType": "semver"
                        },
                        {
                            "version": "16.0",
                            "status": "affected",
                            "lessThan": "16.*",
                            "versionType": "semver"
                        },
                        {
                            "version": "17.0",
                            "status": "affected",
                            "lessThan": "17.*",
                            "versionType": "semver"
                        },
                        {
                            "version": "18.0",
                            "status": "affected",
                            "lessThan": "18.*",
                            "versionType": "semver"
                        },
                        {
                            "version": "19.0",
                            "status": "affected",
                            "lessThan": "19.*",
                            "versionType": "semver"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 13 Nov 06:58 UTC · 274 of 275 readable · 272 fully read · documentation 469/469 current