Node.js contains a flaw in its Permission Model where the filesystem function fs.realpathSync.native() does not enforce read permission checks as required. While other comparable filesystem functions correctly enforce these checks, this function can be used to bypass restrictions imposed by the --permission flag with limited --allow-fs-read access. This allows code running under these restricted permissions to access filesystem information beyond the intended scope, including checking file existence, resolving symbolic links, and enumerating paths outside allowed directories. The issue affects Node.js versions prior to 20.20.2, versions from 21.0.0 up to but not including 22.22.2, versions from 23.0.0 up to but not including 24.14.1, and versions from 25.0.0 up to but not including 25.8.2. A patch is available to address this vulnerability.

The impact is limited to bypassing read permission restrictions in the Node.js Permission Model. Attackers or code running with restricted filesystem read permissions can use fs.realpathSync.native() to access filesystem metadata and paths outside the permitted scope. This could lead to information disclosure about the filesystem structure and existence of files or symlinks that should be inaccessible under the configured permissions. There are no known exploits in the wild, and the severity is assessed as low.

A patch is available for this vulnerability. Users should upgrade Node.js to versions 20.20.2 or later, 22.22.2 or later, 24.14.1 or later, or 25.8.2 or later to ensure the issue is fixed. Until patched, avoid relying solely on the Permission Model's --allow-fs-read restrictions for security, as fs.realpathSync.native() can bypass these controls.