Node.js · Report #3761342
Permission Model: --allow-fs-read/--allow-fs-write radix-tree prefix-boundary over-grant
Validstatus
highseverity
33upvotes
29 Jul 2026disclosed
Summary
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.
Under --permission, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist.
This vulnerability affects Node.js main, 22.x, 24.x, and 26.x.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.