This vulnerability in Node.js arises from incorrect default permissions in the Permission API, which can lead to unauthorized modification of file metadata even on paths designated as read-only via options such as --allow-fs-read. The flaw affects the Node.js versions 22.22.3, 24.16.0, and 26.3.0. The CVSS 3.0 base score is 3.3, indicating low severity, with an attack vector requiring local access and low privileges. There is no evidence of known exploits in the wild, and no official remediation or patch has been documented at this time.

The vulnerability allows local users with limited privileges to modify file metadata on paths that should be read-only, potentially undermining file integrity controls. However, it does not impact confidentiality or availability, and the overall severity is low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Node.js vendor advisories for updates. Until a fix is available, avoid running untrusted code with elevated permissions or using the --allow-fs-read flag in sensitive environments.