BIT-node-min-2026-106073: Low severity bitnami/node vulnerability

Q: Who is exposed to this issue?

Deployments using affected Node.js 26.x, 24.x, or 22.x releases are exposed when they run code with the Permission Model enabled and restrict filesystem reads using --allow-fs-read. The issue affects bitnami/node and bitnami/node-min.

Q: What does an attacker need to exploit it?

An attacker needs the ability to cause code to call fs.realpathSync() within a Node.js process running under --permission. Exploitation requires only low privileges and no user interaction.

Q: What can be exposed despite restricted filesystem read permissions?

Code can use fs.realpathSync() to determine whether files exist, resolve symlink targets, and enumerate filesystem paths outside the directories permitted by --allow-fs-read. The described impact is limited to confidentiality.

Published Oct 29, 2026

Updated

A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync() without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered fs.realpathSync.native().

As a result, code running under --permission with restricted --allow-fs-read can still use fs.realpathSync() to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.

This vulnerability affects Node.js 26.x, 24.x, and 22.x.

Affected Software

6 affected componentsFixes available

bitnami/node<22.23.4

22.23.4

bitnami/node>=23.0.0<24.22.1

24.22.1

bitnami/node>=25.0.0<26.12.1

26.12.1

bitnami/node-min<22.23.4

22.23.4

bitnami/node-min>=23.0.0<24.22.1

24.22.1

bitnami/node-min>=25.0.0<26.12.1

26.12.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade bitnami/node to a version that resolves this vulnerability.
Fixed in 22.23.4
Upgrade
Upgrade bitnami/node to a version that resolves this vulnerability.
Fixed in 24.22.1
Upgrade
Upgrade bitnami/node to a version that resolves this vulnerability.
Fixed in 26.12.1
Upgrade
Upgrade bitnami/node-min to a version that resolves this vulnerability.
Fixed in 22.23.4
Upgrade
Upgrade bitnami/node-min to a version that resolves this vulnerability.
Fixed in 24.22.1
Upgrade
Upgrade bitnami/node-min to a version that resolves this vulnerability.
Fixed in 26.12.1

Event History

Oct 29, 2026

Advisory Published

via OSV·08:56 AM

Data Sourced

via OSV·08:56 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Deployments using affected Node.js 26.x, 24.x, or 22.x releases are exposed when they run code with the Permission Model enabled and restrict filesystem reads using --allow-fs-read. The issue affects bitnami/node and bitnami/node-min.

What does an attacker need to exploit it?

An attacker needs the ability to cause code to call fs.realpathSync() within a Node.js process running under --permission. Exploitation requires only low privileges and no user interaction.

What can be exposed despite restricted filesystem read permissions?

Code can use fs.realpathSync() to determine whether files exist, resolve symlink targets, and enumerate filesystem paths outside the directories permitted by --allow-fs-read. The described impact is limited to confidentiality.

BIT-node-min-2026-106073: Low severity bitnami/node vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What can be exposed despite restricted filesystem read permissions?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What can be exposed despite restricted filesystem read permissions?