CVE-2024-21891

Node.js depends on multiple built-in utility functions to normalize paths
provided to node:fs functions, which can be overwitten with user-defined
implementations leading to filesystem permission model bypass through path
traversal attack. This vulnerability affects all users using the
experimental permission model in Node.js 20 and Node.js 21. Please note
that at the time this CVE was issued, the permission model is an
experimental feature of Node.js.