This vulnerability in Node.js arises from a flaw in the permissions model that permits bypassing the --allow-fs-read and --allow-fs-write flags via crafted relative symbolic link paths. By chaining directories and symlinks, an attacker can escape the intended directory restrictions and perform arbitrary file read and write operations beyond the allowed scope. This undermines the expected isolation and can lead to potential system compromise. The issue affects Node.js versions 20, 22, 24, and 25, specifically the versions 20.19.6, 22.21.1, 24.12.0, and 25.2.1 as identified. Red Hat has released security advisories and patches for their Node.js builds to remediate this vulnerability.

Successful exploitation allows an attacker with limited permissions to bypass filesystem read/write restrictions imposed by Node.js's permission model. This can lead to unauthorized reading and writing of arbitrary files outside the permitted directory, breaking isolation guarantees. The impact includes potential exposure of sensitive information and possible system compromise due to unauthorized file manipulation. The CVSS score of 7.1 reflects high confidentiality and integrity impact with no impact on availability.

Red Hat has published security advisories and issued updated Node.js packages that fix this vulnerability. Users of affected Node.js versions on Red Hat Enterprise Linux should apply the official security updates as detailed in Red Hat advisories (e.g., RHSA-2026:2899). Since this is not a cloud service, remediation requires updating the affected Node.js packages to the fixed versions provided by the vendor. Patch status is confirmed by Red Hat advisories. No alternative mitigations are specified beyond applying the vendor-provided updates.