Threats tagged 'bit-node-2026-21715'

A vulnerability in Node.js Permission Model filesystem enforcement allows the function fs.realpathSync.native() to bypass required read permission checks. This flaw affects Node.js versions 20.x, 22.x, 24.x, and 25.x when running with restricted --allow-fs-read permissions. Exploiting this issue, code can check file existence, resolve symlink targets, and enumerate filesystem paths outside permitted directories despite restrictions. The vulnerability has a low severity rating and no known exploits in the wild. Patches are available for affected versions.