Permission Model Bypass in Node.js Affects Recursive File Watching

CVE-2026-123829

What is CVE-2026-123829?

A permission model bypass vulnerability exists in Node.js related to recursive file watching, where it incorrectly allows access to filenames and directory names that should be protected. When using fs.watch() and fs.promises.watch() on macOS and Windows, the underlying libuv watcher fails to check if each path being reported is permitted under the current read grant. This allows unauthorized file names, such as 'sub/secret.txt', to be disclosed, even when access to the directory itself is denied. The flaw exposes names and timing metadata instead of file contents, and is dependent on files created in the watched directory by another user.

References