AZL-81263

See a problem?
Import Source
https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-81263.json
JSON Data
https://api.osv.dev/v1/vulns/AZL-81263
Upstream
Published
2026-03-30T20:16:19Z
Modified
2026-08-28T17:47:55.044327633Z
Summary
CVE-2026-21715 affecting package nodejs24 for versions less than 24.14.1-1
Details

A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync.native() without the required read permission checks, while all comparable filesystem functions correctly enforce them.

As a result, code running under --permission with restricted --allow-fs-read can still use fs.realpathSync.native() to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.

This vulnerability affects 20.x, 22.x, 24.x, and 25.x processes using the Permission Model where --allow-fs-read is intentionally restricted.

References

Affected packages

Azure Linux:3 / nodejs24

Package

Name
nodejs24
Purl
pkg:rpm/azure-linux/nodejs24

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
24.14.1-1

Database specific

source 
"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-81263.json"