BIT-node-min-2026-21715

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/node-min/BIT-node-min-2026-21715.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-node-min-2026-21715
Aliases
Published
2026-04-06T07:58:55.813Z
Modified
2026-04-06T08:41:21.481070241Z
Summary
[none]
Details

A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync.native() without the required read permission checks, while all comparable filesystem functions correctly enforce them.

As a result, code running under --permission with restricted --allow-fs-read can still use fs.realpathSync.native() to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.

This vulnerability affects 20.x, 22.x, 24.x, and 25.x processes using the Permission Model where --allow-fs-read is intentionally restricted.

Database specific 
{
    "severity": "Low",
    "cpes": [
        "cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*"
    ]
}
References

Affected packages

Bitnami / node-min

Package

Name
node-min
Purl
pkg:bitnami/node-min

Severity

  • 3.3 (Low) CVSS_V3 - CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
20.20.2
Introduced
21.0.0
Fixed
24.14.1
Introduced
25.0.0
Fixed
25.8.2

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/node-min/BIT-node-min-2026-21715.json"