REDHAT-BUG-2431338: Medium severity npm/node vulnerability
A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via futimes() even when the process has only read permissions. Unlike utimes(), futimes() does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2431338?
The severity of REDHAT-BUG-2431338 is medium, with a risk score of 4.
How does REDHAT-BUG-2431338 impact Node.js applications?
REDHAT-BUG-2431338 allows unauthorized changes to file metadata through `futimes()` without requiring write permissions, posing a risk of unauthorized data manipulation.
What versions of Node.js are affected by REDHAT-BUG-2431338?
The specific versions affected by REDHAT-BUG-2431338 have not been detailed, but the flaw exists in the permission model of certain Node.js implementations.
How can I mitigate the risks associated with REDHAT-BUG-2431338?
To mitigate risks from REDHAT-BUG-2431338, ensure that Node.js is updated to the latest stable version where this issue is addressed.
What should I do if I am using npm with REDHAT-BUG-2431338?
If using npm and affected by REDHAT-BUG-2431338, it is advisable to review your permission settings and update to a patched version of Node.js as soon as possible.