CVE-2026-21716
Permission Bypass in Node.js FileHandle Promise API Methods
Publication date: 2026-03-30
Last updated on: 2026-03-31
Assigner: HackerOne
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| nodejs | node.js | From 20.0 (inc) to 25.0 (inc) |
| nodejs | node.js | From 20.x (inc) to 25.x (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is due to an incomplete fix for a previous issue (CVE-2024-36137) in Node.js. Specifically, the promise-based methods FileHandle.chmod() and FileHandle.chown() do not perform the required permission checks. While the callback-based equivalents (fs.fchmod() and fs.fchown()) were correctly patched, the promise-based methods allow code running with restricted file system write permissions (--allow-fs-write) to still modify file permissions and ownership on already-open file descriptors. This effectively bypasses the intended write restrictions.
How can this vulnerability impact me? :
The impact of this vulnerability is that an attacker or malicious code running with limited permissions can escalate their ability to modify file permissions and ownership. This means they can change access controls on files even when write permissions are supposed to be restricted, potentially leading to unauthorized file modifications or privilege escalation within the affected Node.js processes.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that you do not rely solely on the promises API methods FileHandle.chmod() and FileHandle.chown() for permission checks, as they lack the required enforcement.
Restrict or avoid using the affected Node.js versions 20.x, 22.x, 24.x, and 25.x with the Permission Model where --allow-fs-write is restricted until a proper patch is applied.
Monitor for updates or patches from Node.js that address this incomplete fix and apply them promptly.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows bypassing intended write restrictions on file permissions and ownership in Node.js processes using the Permission Model with restricted file system write permissions.
Such unauthorized modification capabilities could potentially lead to unauthorized changes in file system permissions and ownership, which may impact the security controls required for compliance with standards like GDPR and HIPAA.
However, the provided information does not explicitly describe the direct impact on compliance with these regulations.