Filesystem Vulnerability in Node.js Across Multiple Versions

CVE-2026-21715

What is CVE-2026-21715?

A security flaw within the Node.js Permission Model allows the function fs.realpathSync.native() to bypass necessary read permission checks. While other filesystem functions correctly enforce permissions, this oversight means that code executed with restricted access under the --permission flag can still leverage fs.realpathSync.native() to verify file existence, target symlink resolution, and browse filesystem paths beyond the intended directories. This vulnerability impacts Node.js versions 20.x, 22.x, 24.x, and 25.x where --allow-fs-read is limited.

References