Vulnerability-Lookup

CVE-2026-21715 (GCVE-0-2026-21715)

Vulnerability from cvelistv5 – Published: 2026-03-30 19:07 – Updated: 2026-04-01 15:02

Summary

A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them. As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories. This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-read` is intentionally restricted.

Severity

3.3 (Low)


                        
                          CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-01 14:55 UTC

CWE

CWE-732 - Incorrect Permission Assignment for Critical Resource

Assigner

hackerone mitre root

References

1 reference

URL	Tags
https://nodejs.org/en/blog/vulnerability/march-20…

Impacted products

1 product

Vendor	Product	Version	CPE status
nodejs	node	Affected: 20.20.1 , ≤ 20.20.1 (semver) Affected: 22.22.1 , ≤ 22.22.1 (semver) Affected: 24.14.0 , ≤ 24.14.0 (semver) Affected: 25.8.1 , ≤ 25.8.1 (semver) Affected: 4.0 , < 4.* (semver) Affected: 5.0 , < 5.* (semver) Affected: 6.0 , < 6.* (semver) Affected: 7.0 , < 7.* (semver) Affected: 8.0 , < 8.* (semver) Affected: 9.0 , < 9.* (semver) Affected: 10.0 , < 10.* (semver) Affected: 11.0 , < 11.* (semver) Affected: 12.0 , < 12.* (semver) Affected: 13.0 , < 13.* (semver) Affected: 14.0 , < 14.* (semver) Affected: 15.0 , < 15.* (semver) Affected: 16.0 , < 16.* (semver) Affected: 17.0 , < 17.* (semver) Affected: 18.0 , < 18.* (semver) Affected: 19.0 , < 19.* (semver)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-21715",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-01T14:55:13.031405Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-732",
                "description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-01T15:02:10.706Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "node",
          "vendor": "nodejs",
          "versions": [
            {
              "lessThanOrEqual": "20.20.1",
              "status": "affected",
              "version": "20.20.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "22.22.1",
              "status": "affected",
              "version": "22.22.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "24.14.0",
              "status": "affected",
              "version": "24.14.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "25.8.1",
              "status": "affected",
              "version": "25.8.1",
              "versionType": "semver"
            },
            {
              "lessThan": "4.*",
              "status": "affected",
              "version": "4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "5.*",
              "status": "affected",
              "version": "5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.*",
              "status": "affected",
              "version": "6.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.*",
              "status": "affected",
              "version": "7.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.*",
              "status": "affected",
              "version": "8.0",
              "versionType": "semver"
            },
            {
              "lessThan": "9.*",
              "status": "affected",
              "version": "9.0",
              "versionType": "semver"
            },
            {
              "lessThan": "10.*",
              "status": "affected",
              "version": "10.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.*",
              "status": "affected",
              "version": "11.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.*",
              "status": "affected",
              "version": "12.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.*",
              "status": "affected",
              "version": "13.0",
              "versionType": "semver"
            },
            {
              "lessThan": "14.*",
              "status": "affected",
              "version": "14.0",
              "versionType": "semver"
            },
            {
              "lessThan": "15.*",
              "status": "affected",
              "version": "15.0",
              "versionType": "semver"
            },
            {
              "lessThan": "16.*",
              "status": "affected",
              "version": "16.0",
              "versionType": "semver"
            },
            {
              "lessThan": "17.*",
              "status": "affected",
              "version": "17.0",
              "versionType": "semver"
            },
            {
              "lessThan": "18.*",
              "status": "affected",
              "version": "18.0",
              "versionType": "semver"
            },
            {
              "lessThan": "19.*",
              "status": "affected",
              "version": "19.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them.\r\n\r\nAs a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.\r\n\r\nThis vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-read` is intentionally restricted."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-30T19:07:28.507Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-21715",
    "datePublished": "2026-03-30T19:07:28.507Z",
    "dateReserved": "2026-01-04T15:00:06.574Z",
    "dateUpdated": "2026-04-01T15:02:10.706Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-21715",
      "date": "2026-09-16",
      "epss": "0.00158",
      "percentile": "0.05336"
    },
    "microsoft_vex": {
      "current_release_date": "2026-04-09T01:40:20.000Z",
      "cve": "CVE-2026-21715",
      "id": "msrc_CVE-2026-21715",
      "initial_release_date": "2026-03-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them.\r\n\r\nAs a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.\r\n\r\nThis vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-read` is intentionally restricted.",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-21715.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-21715\",\"sourceIdentifier\":\"support@hackerone.com\",\"published\":\"2026-03-30T20:16:19.703\",\"lastModified\":\"2026-08-19T13:32:49.980\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them.\\r\\n\\r\\nAs a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.\\r\\n\\r\\nThis vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-read` is intentionally restricted.\"},{\"lang\":\"es\",\"value\":\"Una falla en la aplicaci\u00f3n del modelo de permisos del sistema de archivos de Node.js deja a \u0027fs.realpathSync.native()\u0027 sin las comprobaciones de permisos de lectura requeridas, mientras que todas las funciones comparables del sistema de archivos las aplican correctamente.\\n\\nComo resultado, el c\u00f3digo que se ejecuta bajo \u0027--permission\u0027 con \u0027--allow-fs-read\u0027 restringido a\u00fan puede usar \u0027fs.realpathSync.native()\u0027 para verificar la existencia de archivos, resolver destinos de enlaces simb\u00f3licos y enumerar rutas del sistema de archivos fuera de los directorios permitidos.\\n\\nEsta vulnerabilidad afecta a los procesos 20.x, 22.x, 24.x y 25.x que utilizan el Modelo de Permisos donde \u0027--allow-fs-read\u0027 est\u00e1 restringido intencionalmente.\"}],\"affected\":[{\"source\":\"support@hackerone.com\",\"affectedData\":[{\"vendor\":\"nodejs\",\"product\":\"node\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"20.20.1\",\"lessThanOrEqual\":\"20.20.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"22.22.1\",\"lessThanOrEqual\":\"22.22.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"24.14.0\",\"lessThanOrEqual\":\"24.14.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"25.8.1\",\"lessThanOrEqual\":\"25.8.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.0\",\"lessThan\":\"4.*\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.0\",\"lessThan\":\"5.*\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.0\",\"lessThan\":\"6.*\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.0\",\"lessThan\":\"7.*\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"8.0\",\"lessThan\":\"8.*\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"9.0\",\"lessThan\":\"9.*\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"10.0\",\"lessThan\":\"10.*\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"11.0\",\"lessThan\":\"11.*\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"12.0\",\"lessThan\":\"12.*\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"13.0\",\"lessThan\":\"13.*\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"14.0\",\"lessThan\":\"14.*\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"15.0\",\"lessThan\":\"15.*\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"16.0\",\"lessThan\":\"16.*\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"17.0\",\"lessThan\":\"17.*\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"18.0\",\"lessThan\":\"18.*\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"19.0\",\"lessThan\":\"19.*\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"support@hackerone.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":3.3,\"baseSeverity\":\"LOW\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.8,\"impactScore\":1.4}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-04-01T14:55:13.031405Z\",\"id\":\"CVE-2026-21715\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-732\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*\",\"versionEndIncluding\":\"20.20.1\",\"matchCriteriaId\":\"42C896A4-ABB4-4DF3-8F8B-320C8E8E6AA3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*\",\"versionStartIncluding\":\"22.0.0\",\"versionEndIncluding\":\"22.22.1\",\"matchCriteriaId\":\"5317F856-6549-4E7C-B6B8-811DE991E7A7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*\",\"versionStartIncluding\":\"24.0.0\",\"versionEndIncluding\":\"24.14.0\",\"matchCriteriaId\":\"DD9D3210-E42B-4584-817D-DAC5F1234234\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*\",\"versionStartIncluding\":\"25.0.0\",\"versionEndIncluding\":\"25.8.1\",\"matchCriteriaId\":\"89D03065-041A-4A59-95C4-B2AE7EE36439\"}]}]}],\"references\":[{\"url\":\"https://nodejs.org/en/blog/vulnerability/march-2026-security-releases\",\"source\":\"support@hackerone.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-30T11:52:48+00:00",
      "cve": "CVE-2026-21715",
      "id": "CVE-2026-21715",
      "initial_release_date": "2026-03-30T19:07:28.507000+00:00",
      "product_status:fixed": "111",
      "product_status:known_affected": "47",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21715.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "low",
      "current_release_date": "2026-09-11T01:38:56Z",
      "cve": "CVE-2026-21715",
      "id": "CVE-2026-21715",
      "initial_release_date": "2026-03-25T16:58:42Z",
      "product_status:known_not_affected": "226",
      "product_status:recommended": "126",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-21715",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-21715.json",
      "version": "16"
    }
  }
}

SUSE-SU-2026:1363-1

Vulnerability from csaf_suse - Published: 2026-04-15 14:16 - Updated: 2026-09-16 09:02

Summary

Security update for nodejs20

Severity

Important

Scope

7 vulnerabilities in this advisory, including CVE-2026-21715.

CVE-2026-21715

3.3 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Recommended: 39 products

Open the full advisory

SUSE-SU-2026:1371-1

Vulnerability from csaf_suse - Published: 2026-04-15 14:46 - Updated: 2026-09-16 09:02

Summary

Security update for nodejs20

Severity

Important

Scope

7 vulnerabilities in this advisory, including CVE-2026-21715.

CVE-2026-21715

3.3 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Recommended: 60 products

Open the full advisory

SUSE-SU-2026:1478-1

Vulnerability from csaf_suse - Published: 2026-04-20 10:09 - Updated: 2026-04-20 10:09

Summary

Security update for nodejs22

Severity

Important

Scope

7 vulnerabilities in this advisory, including CVE-2026-21715.

CVE-2026-21715

3.3 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Recommended: 13 products

Open the full advisory

SUSE-SU-2026:1509-1

Vulnerability from csaf_suse - Published: 2026-04-21 06:27 - Updated: 2026-09-16 09:02

Summary

Security update for nodejs22

Severity

Important

Scope

7 vulnerabilities in this advisory, including CVE-2026-21715.

CVE-2026-21715

3.3 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Recommended: 39 products

Open the full advisory

SUSE-SU-2026:21181-1

Vulnerability from csaf_suse - Published: 2026-04-13 10:59 - Updated: 2026-09-16 09:03

Summary

Security update for nodejs24

Severity

Important

Scope

9 vulnerabilities in this advisory, including CVE-2026-21715.

CVE-2026-21715

3.3 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Recommended: 34 products

Open the full advisory

SUSE-SU-2026:22368-1

Vulnerability from csaf_suse - Published: 2026-06-25 12:57 - Updated: 2026-09-16 09:03

Summary

Security update for nodejs22

Severity

Important

Scope

26 vulnerabilities in this advisory, including CVE-2026-21715.

CVE-2026-21715

3.3 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Recommended: 34 products

Open the full advisory

ubuntu-cve-2026-21715

Vulnerability from osv_ubuntu

Published

2026-03-30 20:16

Modified

2026-05-20 15:24

Summary

Details

A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync.native() without the required read permission checks, while all comparable filesystem functions correctly enforce them. As a result, code running under --permission with restricted --allow-fs-read can still use fs.realpathSync.native() to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories. This vulnerability affects 20.x, 22.x, 24.x, and 25.x processes using the Permission Model where --allow-fs-read is intentionally restricted.

Severity

3.3 (Low)


                    
                      CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-21715	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-21715	REPORT
	https://nodejs.org/en/blog/vulnerability/march-20…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "nodejs",
            "binary_version": "0.10.25~dfsg2-2ubuntu1.2+esm2"
          },
          {
            "binary_name": "nodejs-legacy",
            "binary_version": "0.10.25~dfsg2-2ubuntu1.2+esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "nodejs",
        "purl": "pkg:deb/ubuntu/nodejs@0.10.25~dfsg2-2ubuntu1.2+esm2?arch=source\u0026distro=esm-infra-legacy/trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.10.15~dfsg1-4",
        "0.10.21~dfsg1-1",
        "0.10.22~dfsg1-2",
        "0.10.23~dfsg1-1",
        "0.10.23~dfsg1-2",
        "0.10.23~dfsg1-3",
        "0.10.24~dfsg1-1",
        "0.10.25~dfsg2-2",
        "0.10.25~dfsg2-2ubuntu1",
        "0.10.25~dfsg2-2ubuntu1.2",
        "0.10.25~dfsg2-2ubuntu1.2+esm1",
        "0.10.25~dfsg2-2ubuntu1.2+esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "nodejs",
            "binary_version": "4.2.6~dfsg-1ubuntu4.2+esm3"
          },
          {
            "binary_name": "nodejs-legacy",
            "binary_version": "4.2.6~dfsg-1ubuntu4.2+esm3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "nodejs",
        "purl": "pkg:deb/ubuntu/nodejs@4.2.6~dfsg-1ubuntu4.2+esm3?arch=source\u0026distro=esm-apps/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.10.25~dfsg2-2ubuntu1",
        "4.2.2~dfsg-1",
        "4.2.3~dfsg-1",
        "4.2.4~dfsg-1ubuntu1",
        "4.2.4~dfsg-2",
        "4.2.6~dfsg-1ubuntu1",
        "4.2.6~dfsg-1ubuntu4",
        "4.2.6~dfsg-1ubuntu4.1",
        "4.2.6~dfsg-1ubuntu4.2",
        "4.2.6~dfsg-1ubuntu4.2+esm1",
        "4.2.6~dfsg-1ubuntu4.2+esm2",
        "4.2.6~dfsg-1ubuntu4.2+esm3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "nodejs",
            "binary_version": "8.10.0~dfsg-2ubuntu0.4+esm6"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "nodejs",
        "purl": "pkg:deb/ubuntu/nodejs@8.10.0~dfsg-2ubuntu0.4+esm6?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "6.11.4~dfsg-1ubuntu1",
        "6.11.4~dfsg-1ubuntu2",
        "6.12.0~dfsg-1ubuntu1",
        "6.12.0~dfsg-2ubuntu1",
        "6.12.0~dfsg-2ubuntu2",
        "8.10.0~dfsg-2",
        "8.10.0~dfsg-2ubuntu0.2",
        "8.10.0~dfsg-2ubuntu0.3",
        "8.10.0~dfsg-2ubuntu0.4",
        "8.10.0~dfsg-2ubuntu0.4+esm1",
        "8.10.0~dfsg-2ubuntu0.4+esm2",
        "8.10.0~dfsg-2ubuntu0.4+esm3",
        "8.10.0~dfsg-2ubuntu0.4+esm4",
        "8.10.0~dfsg-2ubuntu0.4+esm5",
        "8.10.0~dfsg-2ubuntu0.4+esm6"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libnode64",
            "binary_version": "10.19.0~dfsg-3ubuntu1.6+esm2"
          },
          {
            "binary_name": "nodejs",
            "binary_version": "10.19.0~dfsg-3ubuntu1.6+esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "nodejs",
        "purl": "pkg:deb/ubuntu/nodejs@10.19.0~dfsg-3ubuntu1.6+esm2?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.15.2~dfsg-2ubuntu1",
        "10.17.0~dfsg-2ubuntu4",
        "10.17.0~dfsg-2ubuntu6",
        "10.19.0~dfsg-3ubuntu1",
        "10.19.0~dfsg-3ubuntu1.1",
        "10.19.0~dfsg-3ubuntu1.2",
        "10.19.0~dfsg-3ubuntu1.3",
        "10.19.0~dfsg-3ubuntu1.5",
        "10.19.0~dfsg-3ubuntu1.6",
        "10.19.0~dfsg-3ubuntu1.6+esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libnode72",
            "binary_version": "12.22.9~dfsg-1ubuntu3.6+esm2"
          },
          {
            "binary_name": "nodejs",
            "binary_version": "12.22.9~dfsg-1ubuntu3.6+esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "nodejs",
        "purl": "pkg:deb/ubuntu/nodejs@12.22.9~dfsg-1ubuntu3.6+esm2?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "12.22.5~dfsg-5ubuntu1",
        "12.22.7~dfsg-2ubuntu1",
        "12.22.7~dfsg-2ubuntu3",
        "12.22.9~dfsg-1ubuntu2",
        "12.22.9~dfsg-1ubuntu3",
        "12.22.9~dfsg-1ubuntu3.1",
        "12.22.9~dfsg-1ubuntu3.2",
        "12.22.9~dfsg-1ubuntu3.3",
        "12.22.9~dfsg-1ubuntu3.4",
        "12.22.9~dfsg-1ubuntu3.5",
        "12.22.9~dfsg-1ubuntu3.6",
        "12.22.9~dfsg-1ubuntu3.6+esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libnode109",
            "binary_version": "18.19.1+dfsg-6ubuntu5"
          },
          {
            "binary_name": "nodejs",
            "binary_version": "18.19.1+dfsg-6ubuntu5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "nodejs",
        "purl": "pkg:deb/ubuntu/nodejs@18.19.1+dfsg-6ubuntu5?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "18.13.0+dfsg1-1ubuntu2",
        "18.19.1+dfsg-2ubuntu4",
        "18.19.1+dfsg-6ubuntu1",
        "18.19.1+dfsg-6ubuntu2",
        "18.19.1+dfsg-6ubuntu5"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libnode115",
            "binary_version": "20.19.4+dfsg-1"
          },
          {
            "binary_name": "nodejs",
            "binary_version": "20.19.4+dfsg-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "nodejs",
        "purl": "pkg:deb/ubuntu/nodejs@20.19.4+dfsg-1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "20.18.1+dfsg-1ubuntu2",
        "20.19.2+dfsg-1",
        "20.19.4+dfsg-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libnode127",
            "binary_version": "22.22.1+dfsg+~cs22.19.15-1ubuntu1"
          },
          {
            "binary_name": "nodejs",
            "binary_version": "22.22.1+dfsg+~cs22.19.15-1ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "nodejs",
        "purl": "pkg:deb/ubuntu/nodejs@22.22.1+dfsg+~cs22.19.15-1ubuntu1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "20.19.4+dfsg-1",
        "20.19.5+dfsg+~cs20.19.12-4",
        "22.21.1+dfsg+~cs22.19.0-6ubuntu4",
        "22.22.0+dfsg+~cs22.19.6-1ubuntu2",
        "22.22.0+dfsg+~cs22.19.13-2ubuntu1",
        "22.22.1+dfsg+~cs22.19.15-1ubuntu1"
      ]
    }
  ],
  "aliases": [],
  "details": "A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them. As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories. This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-read` is intentionally restricted.",
  "id": "UBUNTU-CVE-2026-21715",
  "modified": "2026-05-20T15:24:36Z",
  "published": "2026-03-30T20:16:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-21715"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21715"
    },
    {
      "type": "REPORT",
      "url": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#permission-model-bypass-in-realpathsyncnative-allows-file-existence-disclosure-cve-2026-21715---low"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-21715"
  ]
}

WID-SEC-W-2026-0843

Vulnerability from csaf_certbund - Published: 2026-03-24 23:00 - Updated: 2026-05-25 22:00

Summary

Node.js: Mehrere Schwachstellen

Severity

Mittel

Scope

10 vulnerabilities in this advisory, including CVE-2026-21715.

CVE-2026-21715

Known affected: 12 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-21715 (GCVE-0-2026-21715)

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature

Related by attack behaviour