DEBIAN-CVE-2026-123829: Low severity debian/nodejs vulnerability
A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process is not permitted to read. On macOS and Windows, fs.watch() and fs.promises.watch() in recursive mode are backed by the native libuv watcher: FSEventWrap::Start checks kFileSystemRead only once, on the watched root, and FSEventWrap::OnEvent then forwards every filename libuv reports (relative paths at any depth) to the JavaScript callback without checking that each path is covered by the read grant. Code running under --permission with an exact read grant on a directory can therefore learn names such as sub/secret.txt even though readdir on that subdirectory is denied. The flaw exposes names and timing metadata, not file contents, and requires macOS or Windows plus files created under the watched directory by another actor. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue affects Node.js 22.x, 24.x, and 26.x on macOS or Windows when recursive fs.watch() or fs.promises.watch() is used under --permission. Linux is not identified as affected by the provided data.
What conditions are required for exploitation?
An attacker needs code execution with Node.js permissions enabled and an exact read grant for the watched root directory, while lacking read permission for a subdirectory. Another actor must create files beneath that watched directory so their names and event timing are reported by the recursive watcher.
Is file content exposed?
No. The described impact is limited to filenames, directory names, and timing metadata reported by watcher events; it does not disclose file contents.
What can be done if patching is not immediately possible?
Avoid recursive fs.watch() and fs.promises.watch() on macOS and Windows where permission boundaries between the watched root and descendant directories are relied upon. Do not grant untrusted code permission to watch directory trees that may contain inaccessible subdirectories.