719 matches found
CVE-2026-123829
A Permission Model bypass in Node.js recursive file watching discloses...
CVE-2026-123829
A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process is not permitted to read. On macOS and Windows, fs.watch and fs.promises.watch in recursive mode are backed by the native libuv watcher: FSEventWrap::Start checks kFileSystemRead...
ALPINE-CVE-2026-123829
A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process is not permitted to read. On macOS and Windows, fs.watch and fs.promises.watch in recursive mode are backed by the native libuv watcher: FSEventWrap::Start checks kFileSystemRead...
DEBIAN-CVE-2026-123829
A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process is not permitted to read. On macOS and Windows, fs.watch and fs.promises.watch in recursive mode are backed by the native libuv watcher: FSEventWrap::Start checks kFileSystemRead...
CVE-2026-123829
A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process is not permitted to read. On macOS and Windows, fs.watch and fs.promises.watch in recursive mode are backed by the native libuv watcher: FSEventWrap::Start checks kFileSystemRead...
nodejs: Information disclosure due to improper permission enforcement
A flaw was found in Node.js. The permission model enforcement, specifically related to process.report functionality, allows an attacker to write or overwrite files in locations outside of the intended secure paths. This vulnerability can lead to the disclosure of sensitive information or bypass t...
nodejs: Node.js: Permission Model bypass via `process.report.writeReport()` path misvalidation
A flaw was found in Node.js. This vulnerability allows a bypass of the Permission Model enforcement due to path misvalidation within the process.report.writeReport function. An attacker could exploit this to bypass intended security boundaries, potentially leading to unauthorized access to...
nodejs: Node.js: Permission Model flaw allows trace logs to bypass filesystem write restrictions
A flaw in the Node.js Permission Model allows traceevents.createTracing.enable to bypass --allow-fs-write restrictions and write trace logs outside intended paths, potentially leading to unauthorized information disclosure...
nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw
A flaw in the Node.js Permission Model allows attackers to bypass --permission restrictions, enabling unauthorized read or write access to files and directories...
Important: Red Hat Security Advisory: nodejs26 security, bug fix, and enhancement update
An update for nodejs26 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...
nodejs:26 security update
An update is available for nodejs-nodemon, module.nodejs-packaging, module.nodejs-nodemon, nodejs-packaging. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list...
RLSA-2026:97855 Important: nodejs:26 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: nodejs: Node.js: Permission Model bypass via process.report.writeReport path misvalidation CVE-2026-48617 nodejs: Node.js HTTP Agent: Information...
RHEL 9 : nodejs:26 (RHSA-2026:97855)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:97855 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language...
PT-2026-145383
A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process is not permitted to read. On macOS and Windows, fs.watch and fs.promises.watch in recursive mode are backed by the native libuv watcher: FSEventWrap::Start checks kFileSystemRead...
RHEL 10 : nodejs26 (RHSA-2026:98619)
The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:98619 advisory. Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an...
RockyLinux 9 : nodejs:26 (RLSA-2026:97855)
The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:97855 advisory. nodejs: Node.js: Permission Model bypass via process.report.writeReport path misvalidation CVE-2026-48617 nodejs: Node.js HTTP Agent: Information...
CVE-2026-123829: nodejs node: A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process…
A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process is not permitted to read. On macOS and Windows, fs.watch and fs.promises.watch in recursive mode are backed by the native libuv watcher: FSEventWrap::Start checks kFileSystemRead...
nodejs: Node.js: Permission Model bypass via `process.report.writeReport()` path misvalidation
A flaw was found in Node.js. This vulnerability allows a bypass of the Permission Model enforcement due to path misvalidation within the process.report.writeReport function. An attacker could exploit this to bypass intended security boundaries, potentially leading to unauthorized access to...
Important: Red Hat Security Advisory: nodejs:26 security update
An update for the nodejs:26 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
nodejs: Node.js: Permission Model flaw allows trace logs to bypass filesystem write restrictions
A flaw in the Node.js Permission Model allows traceevents.createTracing.enable to bypass --allow-fs-write restrictions and write trace logs outside intended paths, potentially leading to unauthorized information disclosure...