7.9
High
CVE-2024-21891 Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be…
Description
Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-defined implementations leading to filesystem permission model bypass through path traversal attack. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| nodejs | 21.6.0 | No fix stated |
| nodejs | 20.11.0 | No fix stated |
| Node 21.0 | 21.0 → < 21.6.2 | 21.6.2 |
| Node 20.0 | 20.0 → < 20.11.1 | 20.11.1 |
| Node 19.0 | 19.0 → latest | No fix stated |
| Node 17.0 | 17.0 → latest | No fix stated |
| Node 16.0 | 16.0 → latest | No fix stated |
| Node 15.0 | 15.0 → latest | No fix stated |
| Node 14.0 | 14.0 → latest | No fix stated |
Show the 10 other branches Hide the 10 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Node 13.0 | 13.0 → latest | No fix stated |
| Node 12.0 | 12.0 → latest | No fix stated |
| Node 11.0 | 11.0 → latest | No fix stated |
| Node 10.0 | 10.0 → latest | No fix stated |
| Node 9.0 | 9.0 → latest | No fix stated |
| Node 8.0 | 8.0 → latest | No fix stated |
| Node 7.0 | 7.0 → latest | No fix stated |
| Node 6.0 | 6.0 → latest | No fix stated |
| Node 5.0 | 5.0 → latest | No fix stated |
| Node 4.0 | 4.0 → latest | No fix stated |
References
- hackerone.com hackerone.com
- security.netapp.com security.netapp.com
- www.openwall.com www.openwall.com
Timeline
- Published
- Last modified
Other CVEs of nodejs
The 16 CVEs of nodejs →
CVE-2025-27210
An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like…
7.5
High
CVE-2023-46809
Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL…
7.4
High
CVE-2024-36138
Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible…
8.1
High
CVE-2023-39333
Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code
5.3
Medium