References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Change History

HackerOne http://www.openwall.com/lists/oss-security/2024/07/19/3 [No types assigned]

HackerOne http://www.openwall.com/lists/oss-security/2024/07/11/6 [No types assigned]

HackerOne AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used.
This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to.
This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.
Please note that at the time this

HackerOne https://hackerone.com/reports/2145862 [No types assigned]