A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used. Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a "read-only" file descriptor to change the owner and permissions of a file.

🗓️ 04 Sep 2025 04:22:37Reported by MicrosoftType

Node.js experimental permission model flaw with --allow-fs-write lets a read-only descriptor change file owner or permissions.

Reporter	Title	Published	Views	Family All 120
IBM Security Bulletins	Security Bulletin: Vulnerability in Node.js affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component.	11 Mar 202517:20	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM SDK for Node.js affect IBM Business Automation Workflow	9 Oct 202413:22	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Controller is affected by vulnerabilities	15 Apr 202502:55	–	ibm
ATTACKERKB	CVE-2026-21716	30 Mar 202619:07	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : nodejs20, nodejs20-devel, nodejs20-full-i18n (ALAS2023-2024-749)	31 Oct 202400:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : nodejs20, nodejs20-devel, nodejs20-full-i18n (ALAS2023-2024-768)	14 Nov 202400:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0247: nodejs:20 (ALINUX3-SA-2024:0247)	14 May 202500:00	–	nessus
Tenable Nessus	AlmaLinux 8 : nodejs:20 (ALSA-2024:5814)	26 Aug 202400:00	–	nessus
Tenable Nessus	AlmaLinux 9 : nodejs:20 (ALSA-2024:5815)	26 Aug 202400:00	–	nessus
Tenable Nessus	GLSA-202505-11 : Node.js: Multiple Vulnerabilities	14 May 202500:00	–	nessus