Insecure File Permission Management in Node.js by Joyent

CVE-2026-21716

What is CVE-2026-21716?

A vulnerability in Node.js arises from incomplete fixes related to file permission checks in the promises API. Specifically, the FileHandle.chmod() and FileHandle.chown() methods lack necessary permission checks, allowing unauthorized modification of file permissions and ownership. This issue persists for processes using the Permission Model with restricted --allow-fs-write, potentially exposing sensitive files to unauthorized changes. While the callback-based equivalents (fs.fchmod(), fs.fchown()) have been addressed, the promise-based methods remain vulnerable, posing a significant risk to applications relying on Node.js versions 20.x, 22.x, 24.x, and 25.x.

References