CVE-2026-21715: Permission Model Bypass in realpathSync.native Allows File Existence Disclosure
A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync.native() without the required read permission checks, while all comparable filesystem functions correctly enforce them.
As a result, code running under --permission with restricted --allow-fs-read can still use fs.realpathSync.native() to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.
This vulnerability affects 20.x, 22.x, 24.x, and 25.x processes using the Permission Model where --allow-fs-read is intentionally restricted.
Other sources
A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync.native() without the required read permission checks, while all comparable filesystem functions correctly enforce them.
As a result, code running under --permission with restricted --allow-fs-read can still use fs.realpathSync.native() to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.
— Node.Js
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.20.2Fixed in 22.22.2Fixed in 24.14.1Fixed in 25.8.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.20.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.22.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.14.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 25.8.2
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2026-21715?
CVE-2026-21715 has a high severity due to the lack of required read permission checks in the `fs.realpathSync.native()` function.
How do I fix CVE-2026-21715?
To fix CVE-2026-21715, update to the latest version of Node.js that addresses this vulnerability.
What software versions are affected by CVE-2026-21715?
CVE-2026-21715 affects Node.js versions from 20.0.0 to 21.0.0, 22.0.0 to 23.0.0, 24.0.0 to 25.0.0, and 25.0.0 to 26.0.0.
Can CVE-2026-21715 be exploited?
Yes, CVE-2026-21715 can be exploited by running code with the `--permission` flag, allowing unauthorized filesystem read operations.
What environments are most at risk from CVE-2026-21715?
Environments running Node.js applications with restricted filesystem permissions using `--allow-fs-read` are at the highest risk from CVE-2026-21715.