CVE-2026-21715: 
npm vulnerability analysis and mitigation

CVE-2026-21715 is a Permission Model bypass vulnerability in Node.js that allows code running under --permission with restricted --allow-fs-read to use fs.realpathSync.native() to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories. Disclosed on March 30, 2026, as part of Node.js's March 2026 security release, it affects Node.js versions 20.x, 22.x, 24.x, and 25.x when the Permission Model is in use. It carries a CVSS v3.0 base score of 3.3 (Low) (Node.js Advisory, GitHub Advisory).

The root cause is an incomplete implementation of read permission checks in the Node.js Permission Model (CWE-425: Direct Request / Forced Browsing; CWE-732: Incorrect Permission Assignment for Critical Resource). Specifically, fs.realpathSync.native() — which delegates directly to the underlying OS realpath() syscall — was not instrumented with the same --allow-fs-read enforcement applied to all other comparable filesystem functions such as fs.readFileSync() and fs.realpathSync(). An attacker with local, low-privileged code execution in a Node.js process launched with --permission and intentionally restricted --allow-fs-read can call fs.realpathSync.native() on arbitrary paths to probe the filesystem without triggering a permission error. The vulnerability was reported by researcher 'stif' via HackerOne and fixed by RafaelGSS (Node.js Advisory, GitHub Advisory).

Exploitation allows local low-privileged code to bypass the Node.js Permission Model's filesystem read restrictions, enabling unauthorized disclosure of filesystem structure — including file existence, resolved symlink targets, and directory paths outside the permitted scope. The confidentiality impact is limited (low) and there is no integrity or availability impact, as the vulnerability does not permit reading file contents or modifying the filesystem. In sandboxed or multi-tenant Node.js environments relying on the Permission Model for isolation, this bypass could assist an attacker in mapping sensitive directory structures as a precursor to further attacks (Node.js Advisory, GitHub Advisory).

1. Identify target environment: Confirm the target Node.js process is running with --permission and a restricted --allow-fs-read allowlist (e.g., node --permission --allow-fs-read=/safe/dir app.js).
2. Gain code execution context: Obtain the ability to execute JavaScript within the restricted Node.js process — for example, through a code injection vulnerability in the application or by being an untrusted module loaded by the process.
3. Call fs.realpathSync.native() on restricted paths: Invoke require('fs').realpathSync.native('/etc/passwd') or other sensitive paths. Unlike fs.realpathSync() or fs.readFileSync(), this function does not trigger a permission error.
4. Enumerate filesystem structure: Iterate over candidate paths to check file existence and resolve symlinks outside the permitted directory, building a map of sensitive filesystem locations.
5. Use gathered information: Leverage the disclosed path information to inform further exploitation steps, such as targeting configuration files or secrets whose locations are now known (Node.js Advisory, GitHub Advisory).

• Logs: Node.js application logs showing calls to fs.realpathSync.native() with paths outside the configured --allow-fs-read allowlist; absence of expected ERR_ACCESS_DENIED errors when such paths are accessed.
• Process: Node.js processes launched with --permission and --allow-fs-read flags that exhibit unexpected filesystem path resolution activity in system call traces (e.g., via strace on Linux showing realpath() syscalls to restricted directories).
• Application Behavior: Unexpected enumeration of filesystem paths or symlink resolution in application output or error logs that should have been blocked by the Permission Model.

Node.js has released patched versions addressing CVE-2026-21715: 20.20.2, 22.22.2, 24.14.1, and 25.8.2. Organizations should upgrade to these versions immediately. As a short-term workaround, if immediate upgrade is not possible, review all applications using --permission with --allow-fs-read restrictions and assess whether untrusted code execution is possible; consider avoiding use of fs.realpathSync.native() in sensitive contexts or replacing it with fs.realpathSync() which correctly enforces permissions. IBM API Connect users should consult the IBM advisory for product-specific guidance (Node.js Advisory, IBM Advisory, Microsoft MSRC).

The Node.js project disclosed this vulnerability as part of a broader March 2026 security release that addressed nine CVEs across four release lines, with CVE-2026-21715 rated Low severity. Security news outlets including CyberSecurityNews, GBHackers, and The Cyber Express covered the broader Node.js security release, though coverage focused primarily on the two High severity issues (CVE-2026-21637 and CVE-2026-21710). HeroDevs published a detailed breakdown of the March 2026 Node.js security release. Downstream vendors including Red Hat, SUSE, Debian, Amazon Linux, and openSUSE issued their own advisories and updated packages (Node.js Advisory, HeroDevs Blog).