7.1
High
CVE-2025-55130 A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions…
Description
A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Node | 25.2.1 | No fix stated |
| Node | 24.12.0 | No fix stated |
| Node | 22.21.1 | No fix stated |
| Node | 20.19.6 | No fix stated |
| Red Hat Enterprise Linux AppStream EUS (v. 10.0) | Versions not published | |
| Red Hat Enterprise Linux AppStream (v. 10) | Versions not published | |
| Red Hat Enterprise Linux AppStream (v. 8) | Versions not published | |
| Red Hat Enterprise Linux AppStream EUS (v.9.4) | Versions not published | |
| Red Hat Enterprise Linux AppStream EUS (v.9.6) | Versions not published |
Show the 8 other branches Hide the 8 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux AppStream (v. 9) | Versions not published | |
| Red Hat Hardened Images 22.22 | earliest → < 22.22.0-1.3.hum1 | 22.22.0-1.3.hum1 |
| Red Hat Enterprise Linux 10 | Versions not published | |
| Red Hat Enterprise Linux 10.0 Extended Update Support | Versions not published | |
| Red Hat Enterprise Linux 8 8100020260119100525.489197 | earliest → < 8100020260119100525.489197e6 | 8100020260119100525.489197e6 |
| Red Hat Enterprise Linux 9 9070020260117213748 | earliest → < 9070020260117213748.rhel9 | 9070020260117213748.rhel9 |
| Red Hat Enterprise Linux 9.4 Extended Update Support 9040020260211171433 | earliest → < 9040020260211171433.rhel9 | 9040020260211171433.rhel9 |
| Red Hat Enterprise Linux 9.6 Extended Update Support 9060020260210120402 | earliest → < 9060020260210120402.rhel9 | 9060020260210120402.rhel9 |
References
- nodejs.org nodejs.org
Timeline
- Published
- Last modified
Other CVEs of Node
The 129 CVEs of Node →
CVE-2026-106074
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`,…
4.8
Medium
CVE-2026-106070
A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after…
3.7
Low
CVE-2026-106071
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard…
3.6
Low
CVE-2026-106072
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when…
6.7
Medium