CVE-2026-21716: 
npm vulnerability analysis and mitigation

CVE-2026-21716 is a permission model bypass vulnerability in Node.js titled "CVE-2024-36137 Patch Bypass - FileHandle.chmod/chown." It represents an incomplete fix for CVE-2024-36137, leaving FileHandle.chmod() and FileHandle.chown() in the promises API without the required permission checks, while their callback-based equivalents (fs.fchmod(), fs.fchown()) were correctly patched. The vulnerability affects Node.js versions 20.x, 22.x, 24.x, and 25.x when using the Permission Model with restricted --allow-fs-write. It was disclosed on March 30, 2026, and carries a CVSS v3.0 base score of 3.3 (Low) (Node.js Advisory, GitHub Advisory).

The root cause is classified as CWE-862 (Missing Authorization) and CWE-279 (Incorrect Execution-Assigned Permissions). When Node.js patched CVE-2024-36137, the fix was applied only to the callback-based filesystem API (fs.fchmod(), fs.fchown()), but the equivalent promise-based FileHandle methods were overlooked. An attacker with low privileges running code under the --permission flag can call FileHandle.chmod() or FileHandle.chown() on already-open file descriptors to modify file permissions and ownership, bypassing the --allow-fs-write restriction entirely. The attack vector is local, requires low privileges, and no user interaction (Node.js Advisory, GitHub Advisory).

Successful exploitation allows low-privileged code running under the Node.js Permission Model to modify file permissions and ownership on already-open file descriptors, bypassing the intended --allow-fs-write restrictions. This could enable unauthorized modification of file metadata, potentially allowing an attacker to escalate privileges or alter access controls on protected files within the restricted filesystem scope. The impact is limited to integrity (Low), with no confidentiality or availability impact, and is scoped to the local system (Node.js Advisory, GitHub Advisory).

1. Identify target environment: Confirm the target Node.js process (versions 20.x, 22.x, 24.x, or 25.x) is running with the --permission flag and has --allow-fs-write intentionally restricted.
2. Obtain code execution: Gain the ability to execute JavaScript code within the restricted Node.js process (e.g., via a sandboxed plugin, untrusted module, or low-privileged user context).
3. Open a file descriptor: Use an allowed file operation to obtain an open FileHandle object for a target file (e.g., via fs.promises.open() on a file accessible under current permissions).
4. Invoke vulnerable promise API: Call fileHandle.chmod(mode) or fileHandle.chown(uid, gid) on the open FileHandle — these methods lack permission checks and will execute without triggering the --allow-fs-write restriction.
5. Achieve privilege escalation or access modification: The file's permissions or ownership are now modified, potentially allowing the attacker to access or execute files that were previously restricted (Node.js Advisory).

• Logs: Node.js process logs showing use of FileHandle.chmod() or FileHandle.chown() promise API calls in contexts where --allow-fs-write is restricted; unexpected permission or ownership changes on sensitive files logged by the OS audit subsystem (e.g., auditd on Linux).
• File System: Unexpected changes to file permissions (mode bits) or ownership (UID/GID) on files that should be write-protected under the Node.js Permission Model; files with newly permissive modes (e.g., world-writable) in directories managed by Node.js applications.
• Process: Node.js processes launched with --permission and --allow-fs-write flags that exhibit file metadata changes inconsistent with their declared permissions; unexpected fchmod/fchown syscalls originating from a Node.js process as observed via strace or auditd.

Node.js has released patched versions addressing CVE-2026-21716: 20.20.2, 22.22.2, 24.14.1, and 25.8.2. Organizations should upgrade to these versions immediately, prioritizing systems that use the Permission Model (--permission flag) with restricted --allow-fs-write. As a temporary workaround, avoid relying solely on the Node.js Permission Model for security-critical file access controls, and supplement with OS-level access controls. IBM API Connect users should refer to the IBM advisory for product-specific guidance (Node.js Advisory, IBM Advisory).

The Node.js project disclosed CVE-2026-21716 as part of a broader March 2026 security release addressing nine CVEs across all active release lines. Security news outlets including CyberSecurityNews, GBHackers, and The Cyber Express covered the release, focusing primarily on the higher-severity issues (CVE-2026-21637, CVE-2026-21710) in the same batch. HeroDevs published a detailed blog post summarizing all eight CVEs patched in the March 2026 release. Linux distribution maintainers (Red Hat, openSUSE, Debian, Rocky Linux, AlmaLinux, Amazon Linux) have issued their own advisories and updated packages (Node.js Advisory, IBM Advisory).