{“lastseen”:””,”description”:”A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them.\\r\\n\\r\\nAs a result, code running under `–permission` with restricted `–allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.\\r\\n\\r\\nThis vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `–allow-fs-read` is intentionally restricted.”,”published”:”2026-03-30T19:07:28.507Z”,”modified”:”2026-04-01T15:02:10.706Z”,”type”:”cve”,”title”:”CVE-2026-21715″,”source”:”hackerone”,”references”:”https:\/\/nodejs.org\/en\/blog\/vulnerability\/march-2026-security-releases”,”id”:”CVE-2026-21715″,”bulletinFamily”:””,”cwe”:[“CWE-732″],”cvelist”:null,”sourceData”:”nodejs node 20.20.1\\nnodejs node 22.22.1\\nnodejs node 24.14.0\\nnodejs node 25.8.1\\nnodejs node 4.0\\nnodejs node 5.0\\nnodejs node 6.0\\nnodejs node 7.0\\nnodejs node 8.0\\nnodejs node 9.0\\nnodejs node 10.0\\nnodejs node 11.0\\nnodejs node 12.0\\nnodejs node 13.0\\nnodejs node 14.0\\nnodejs node 15.0\\nnodejs node 16.0\\nnodejs node 17.0\\nnodejs node 18.0\\nnodejs node 19.0″,”sourceHref”:””,”cvss”:{“score”:3.3,”severity”:”LOW”,”vector”:”CVSS:3.0\/AV:L\/AC:L\/PR:L\/UI:N\/S:U\/C:L\/I:N\/A:N”,”version”:”3.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”node”,”version”:”20.20.1″,”vendor”:”nodejs”,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them.\\r\\n\\r\\nAs a…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[6,8,121,12,71,13,7,11,5],"class_list":["post-44714","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-cve","tag-cvss","tag-cvss-33","tag-exploit","tag-low","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n