CVE-2026-123829

A Permission Model bypass in Node.js recursive file watching discloses...

CVE-2026-123829

A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process is not permitted to read. On macOS and Windows, fs.watch and fs.promises.watch in recursive mode are backed by the native libuv watcher: FSEventWrap::Start checks kFileSystemRead...

ALPINE-CVE-2026-123829

A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process is not permitted to read. On macOS and Windows, fs.watch and fs.promises.watch in recursive mode are backed by the native libuv watcher: FSEventWrap::Start checks kFileSystemRead...

DEBIAN-CVE-2026-123829

A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process is not permitted to read. On macOS and Windows, fs.watch and fs.promises.watch in recursive mode are backed by the native libuv watcher: FSEventWrap::Start checks kFileSystemRead...

EUVD-2026-123678

A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process is not permitted to read. On macOS and Windows, fs.watch and fs.promises.watch in recursive mode are backed by the native libuv watcher: FSEventWrap::Start checks kFileSystemRead...

CVE-2026-123829

A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process is not permitted to read. On macOS and Windows, fs.watch and fs.promises.watch in recursive mode are backed by the native libuv watcher: FSEventWrap::Start checks kFileSystemRead...

CVE-2026-123829 Node.js is vulnerable to Permission Model file-name disclosure via recursive fs.watch

A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process is not permitted to read. On macOS and Windows, fs.watch and fs.promises.watch in recursive mode are backed by the native libuv watcher: FSEventWrap::Start checks kFileSystemRead...

CVE-2026-123829

Node.js versions 26.x, 24.x, and 22.x are vulnerable to a Permission Model bypass during recursive file watching on macOS and Windows . The flaw exists because fs.watch() and fs.promises.watch() use the native libuv watcher, where FSEventWrap::Start only checks for read permissions on the root di...

CVE-2026-123829

A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process is not permitted to read. On macOS and Windows, fs.watch and fs.promises.watch in recursive mode are backed by the native libuv watcher: FSEventWrap::Start checks kFileSystemRead...

PT-2026-145383

A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process is not permitted to read. On macOS and Windows, fs.watch and fs.promises.watch in recursive mode are backed by the native libuv watcher: FSEventWrap::Start checks kFileSystemRead...

Node.js < 22.23.5, < 24.22.3, < 26.13.1 - Missing Permission Check on Descendant Paths in Recursive fs.watch() leading to Disclosure of Denied File Names

Missing Permission Check on Descendant Paths in Recursive fs.watch leading to Disclosure of Denied File Names vulnerability discovered by ? in WordPress npm Node.js versions 26.13.1...

CVE-2026-123829: nodejs node: A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process…

A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process is not permitted to read. On macOS and Windows, fs.watch and fs.promises.watch in recursive mode are backed by the native libuv watcher: FSEventWrap::Start checks kFileSystemRead...

Malicious code in imgbundle (npm)

Source: amazon-inspector e14218599b46d143fa8e150156864d14d58c327bd8a8816221ac4e8c5cc99350 The package advertises itself as an image bundler, but index.js performs no image bundling. On require, a top-level IIFE reads an AES-256-CBC-encrypted file at cdn-img-fetch/.cache/banner.jpg inside the...

MAL-2026-17330 Malicious code in imgbundle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e14218599b46d143fa8e150156864d14d58c327bd8a8816221ac4e8c5cc99350 The package advertises itself as an image bundler, but index.js performs no image bundling. On require, a top-level IIFE reads an AES-256-CBC-encrypt...