Skip to content
fr Sign in
3.6 Low

CVE-2024-37372 The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be…

Description

The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases.

Affected products and versions

Product Affected versions Fixed in
Node 22.0 22.0 → < 22.4.1 22.4.1
Node 21.0 21.0 → latest No fix stated
Node 20.0 20.0 → < 20.15.1 20.15.1
Node 19.0 19.0 → latest No fix stated
Node 17.0 17.0 → latest No fix stated
Node 16.0 16.0 → latest No fix stated
Node 15.0 15.0 → latest No fix stated
Node 14.0 14.0 → latest No fix stated
Node 13.0 13.0 → latest No fix stated
Show the 9 other branches
Product Affected versions Fixed in
Node 12.0 12.0 → latest No fix stated
Node 11.0 11.0 → latest No fix stated
Node 10.0 10.0 → latest No fix stated
Node 9.0 9.0 → latest No fix stated
Node 8.0 8.0 → latest No fix stated
Node 7.0 7.0 → latest No fix stated
Node 6.0 6.0 → latest No fix stated
Node 5.0 5.0 → latest No fix stated
Node 4.0 4.0 → latest No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Node

The 129 CVEs of Node →
CVE-2026-106071 A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard… 3.6 Low CVE-2026-106073 A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read… 3.3 Low CVE-2026-106072 A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when… 6.7 Medium CVE-2026-106070 A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after… 3.7 Low
Track this CVE