ALPINE-CVE-2026-123829: Low severity alpine/nodejs vulnerability
A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process is not permitted to read. On macOS and Windows, fs.watch() and fs.promises.watch() in recursive mode are backed by the native libuv watcher: FSEventWrap::Start checks kFileSystemRead only once, on the watched root, and FSEventWrap::OnEvent then forwards every filename libuv reports (relative paths at any depth) to the JavaScript callback without checking that each path is covered by the read grant. Code running under --permission with an exact read grant on a directory can therefore learn names such as sub/secret.txt even though readdir on that subdirectory is denied. The flaw exposes names and timing metadata, not file contents, and requires macOS or Windows plus files created under the watched directory by another actor. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 22.23.5-r0 - Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 24.22.3-r0 - Upgrade
Upgrade
alpine/nodejs-currentto a version that resolves this vulnerability.Fixed in 26.13.1-r0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue affects Node.js 26.x, 24.x, and 22.x on macOS or Windows when recursive fs.watch() or fs.promises.watch() is used under --permission. It requires an exact read grant on the watched root directory while nested paths are not covered by that grant.
What does an attacker need to exploit the disclosure?
An attacker needs code execution with low privileges in the affected Node.js process and the ability to observe recursive watch callbacks. Files must also be created beneath the watched directory by another actor for their names and timing metadata to be disclosed.
Are file contents exposed?
No. The described impact is limited to filenames and directory names, along with timing metadata; it does not grant access to file contents.
How can I determine whether an application is affected?
Check whether it runs Node.js 22.x, 24.x, or 26.x on macOS or Windows with --permission, uses recursive fs.watch() or fs.promises.watch(), and grants read access only to the watched root rather than nested directories. Affected behavior is indicated when watch events reveal nested names that cannot be listed with readdir.