Threats tagged 'bit-node-2026-106073'

A flaw in the Node.js Permission Model filesystem enforcement causes fs.realpathSync() to bypass required read permission checks. This incomplete fix of CVE-2026-21715 allows code running with restricted --allow-fs-read permissions to use fs.realpathSync() to access filesystem paths outside permitted directories. The vulnerability affects Node.js versions 22.x, 24.x, and 26.x prior to specific fixed releases.