UBUNTU-CVE-2026-123829: Medium severity ubuntu/nodejs vulnerability
A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process is not permitted to read. On macOS and Windows, fs.watch() and fs.promises.watch() in recursive mode are backed by the native libuv watcher: FSEventWrap::Start checks kFileSystemRead only once, on the watched root, and FSEventWrap::OnEvent then forwards every filename libuv reports (relative paths at any depth) to the JavaScript callback without checking that each path is covered by the read grant. Code running under --permission with an exact read grant on a directory can therefore learn names such as sub/secret.txt even though readdir on that subdirectory is denied. The flaw exposes names and timing metadata, not file contents, and requires macOS or Windows plus files created under the watched directory by another actor. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Affected Software
Event History
Frequently Asked Questions
Are Ubuntu systems affected by this issue?
The described bypass requires macOS or Windows recursive file watching backed by the native libuv watcher. The provided information does not describe Linux as affected.
What conditions are required for an attacker to observe denied descendant names?
The process must run with --permission and have an exact read grant on a watched directory, while recursive fs.watch() or fs.promises.watch() is used. Files must also be created beneath that directory by another actor.
Does the issue expose file contents?
No. The exposure is limited to filenames, directory names, and timing metadata for events reported from denied descendant paths.
Which Node.js release lines are affected?
Node.js 26.x, 24.x, and 22.x are identified as affected.