CVE-2026-21715: Node.js Privilege Escalation Vulnerability

CVE-2026-21715 Overview

A flaw exists in the Node.js Permission Model filesystem enforcement where the fs.realpathSync.native() function fails to perform required read permission checks, while all other comparable filesystem functions correctly enforce them. This vulnerability allows code running under --permission with restricted --allow-fs-read to bypass filesystem access controls and enumerate paths outside of permitted directories.

Critical Impact

Applications relying on Node.js Permission Model for filesystem sandboxing may be vulnerable to information disclosure through path enumeration, symlink resolution, and file existence checks outside permitted directories.

Affected Products

• Node.js 20.x (using Permission Model with restricted --allow-fs-read)
• Node.js 22.x (using Permission Model with restricted --allow-fs-read)
• Node.js 24.x (using Permission Model with restricted --allow-fs-read)
• Node.js 25.x (using Permission Model with restricted --allow-fs-read)

Discovery Timeline

• 2026-03-30 - CVE CVE-2026-21715 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-21715

Vulnerability Analysis

This vulnerability represents an Improper Permissions Assignment (CWE-732) within Node.js's experimental Permission Model. The Permission Model is designed to restrict access to specific resources during code execution, including filesystem read and write operations through the --allow-fs-read and --allow-fs-write flags.

The core issue lies in an inconsistency in permission enforcement across filesystem APIs. While functions like fs.readFileSync(), fs.realpathSync(), and other filesystem operations properly check whether the calling code has permission to access the requested path, the native implementation fs.realpathSync.native() was overlooked and does not perform these permission checks.

Root Cause

The root cause is a missing permission validation check in the native implementation of realpathSync. When the Permission Model was implemented, the standard JavaScript-based filesystem functions were properly instrumented to verify that the requested path falls within the allowed directories specified by --allow-fs-read. However, the native binding for realpathSync.native() bypasses this permission layer entirely, allowing direct filesystem queries without restriction.

This creates an asymmetry where security-conscious developers who carefully restrict filesystem access using the Permission Model may unknowingly leave an exploitation vector available through this unprotected function.

Attack Vector

The attack requires local access to a Node.js process running with the Permission Model enabled. An attacker with the ability to execute JavaScript code within a sandboxed Node.js environment can exploit this vulnerability to:

1. Check file existence - Determine whether specific files or directories exist outside the permitted filesystem scope
2. Resolve symlink targets - Discover where symbolic links point, potentially revealing sensitive filesystem structure
3. Enumerate filesystem paths - Map out directory structures beyond the intended sandbox boundaries

This can lead to information disclosure about the host filesystem, which may aid in further attacks or reveal sensitive configuration details.

The exploitation pattern involves calling fs.realpathSync.native() with paths that should be blocked by the Permission Model. Instead of receiving a permission error, the attacker receives either the resolved real path (confirming existence) or a "no such file" error (confirming non-existence).

For detailed technical information and exploitation patterns, refer to the Node.js March 2026 Security Releases advisory.

Detection Methods for CVE-2026-21715

Indicators of Compromise

• Unexpected calls to fs.realpathSync.native() in application logs when Permission Model is enabled
• Filesystem probing patterns from sandboxed Node.js processes
• Error logs showing resolved paths for directories outside the permitted --allow-fs-read scope

Detection Strategies

• Monitor application code for usage of fs.realpathSync.native() when the Permission Model is enabled
• Implement code auditing to identify any direct usage of the native realpath function
• Review third-party dependencies for usage of fs.realpathSync.native() that could be exploited
• Enable verbose logging for Permission Model operations to detect bypass attempts

Monitoring Recommendations

• Audit Node.js applications using --permission flag for calls to fs.realpathSync.native()
• Implement runtime monitoring for filesystem enumeration patterns in sandboxed environments
• Review application dependencies with SentinelOne Singularity to detect vulnerable Node.js versions
• Configure alerts for unexpected filesystem access patterns from restricted processes

How to Mitigate CVE-2026-21715

Immediate Actions Required

• Upgrade Node.js to a patched version as outlined in the official security advisory
• Audit application code and dependencies for usage of fs.realpathSync.native()
• Replace fs.realpathSync.native() with fs.realpathSync() which properly enforces Permission Model restrictions
• Consider additional filesystem sandboxing mechanisms at the OS level if immediate upgrade is not possible

Patch Information

Node.js has released security patches addressing this vulnerability across all affected release lines. Organizations should update to the latest patched versions of Node.js 20.x, 22.x, 24.x, and 25.x as documented in the Node.js March 2026 Security Releases advisory.

Workarounds

• Avoid using fs.realpathSync.native() in applications relying on the Permission Model for security isolation
• Use the standard fs.realpathSync() function which correctly enforces permission checks
• Implement additional application-level path validation before calling any realpath functions
• Consider containerization or OS-level sandboxing as defense-in-depth measures

# Configuration example
# When running Node.js with Permission Model, use the standard realpathSync
# instead of the native variant until patched

# Verify your Node.js version
node --version

# Check if application uses the vulnerable function
grep -r "realpathSync.native" ./src ./node_modules --include="*.js"

# Update Node.js to the latest patched version
nvm install 20 --reinstall-packages-from=current