CVE-2026-21716: Node.js Permission Bypass Vulnerability

CVE-2026-21716 Overview

An incomplete fix for CVE-2024-36137 leaves FileHandle.chmod() and FileHandle.chown() in the Node.js promises API without the required permission checks, while their callback-based equivalents (fs.fchmod(), fs.fchown()) were correctly patched. As a result, code running under --permission with restricted --allow-fs-write can still use promise-based FileHandle methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions.

This authorization bypass vulnerability affects Node.js 20.x, 22.x, 24.x, and 25.x processes using the Permission Model where --allow-fs-write is intentionally restricted.

Critical Impact

Applications relying on Node.js Permission Model for filesystem write restrictions may be vulnerable to unauthorized permission and ownership modifications through the promises-based FileHandle API.

Affected Products

• Node.js 20.x with Permission Model enabled
• Node.js 22.x with Permission Model enabled
• Node.js 24.x with Permission Model enabled
• Node.js 25.x with Permission Model enabled

Discovery Timeline

• 2026-03-30 - CVE-2026-21716 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-21716

Vulnerability Analysis

This vulnerability represents a classic case of incomplete patching (CWE-862: Missing Authorization). When CVE-2024-36137 was addressed, the security fix was applied to the callback-based filesystem functions (fs.fchmod() and fs.fchown()) but the corresponding promise-based methods on the FileHandle class were overlooked.

The Node.js Permission Model is designed to provide a security boundary for untrusted code execution, allowing administrators to restrict filesystem access through flags like --allow-fs-write. When this permission is restricted, applications should be prevented from modifying file permissions and ownership.

However, because FileHandle.chmod() and FileHandle.chown() lack the necessary permission validation checks, an attacker with access to an already-open file descriptor can invoke these methods to:

• Modify file permissions (e.g., making files world-readable or executable)
• Change file ownership to arbitrary users or groups

This bypass is particularly concerning in multi-tenant environments or sandboxed execution contexts where the Permission Model is relied upon for security isolation.

Root Cause

The root cause is an incomplete security patch for the original CVE-2024-36137 vulnerability. When the fix was implemented for the callback-based filesystem APIs, the corresponding promise-based FileHandle methods were not updated with the same permission checks. This asymmetric patching left the promises API as an exploitable pathway to bypass filesystem write restrictions enforced by the Permission Model.

Attack Vector

The attack requires local access and low privileges. An attacker must be able to execute JavaScript code within a Node.js process that has the Permission Model enabled with restricted --allow-fs-write permissions. The attacker would:

1. Obtain a FileHandle object for a file they have access to read
2. Call FileHandle.chmod() or FileHandle.chown() on the open file descriptor
3. Successfully modify file permissions or ownership despite the --allow-fs-write restriction

The attack is limited to files where the attacker already has an open file descriptor, constraining the scope of exploitable targets. However, in scenarios where untrusted code can open files for reading and then escalate to modification capabilities, this represents a significant permission boundary violation.

Detection Methods for CVE-2026-21716

Indicators of Compromise

• Unexpected calls to FileHandle.chmod() or FileHandle.chown() in application logs
• File permission or ownership changes that cannot be attributed to authorized operations
• Processes running with --permission flag exhibiting filesystem modification behavior
• Audit trail gaps where files were modified without corresponding authorized API calls

Detection Strategies

• Implement application-level logging for all FileHandle method invocations
• Monitor filesystem permission and ownership changes using OS-level auditing (auditd on Linux)
• Review application code for usage of promise-based FileHandle methods in permission-restricted contexts
• Deploy runtime application security monitoring to detect unauthorized filesystem operations

Monitoring Recommendations

• Enable filesystem auditing on sensitive directories and files
• Configure alerts for permission changes on critical system files
• Implement code review processes to identify promise-based FileHandle usage patterns
• Monitor Node.js application logs for suspicious FileHandle API activity

How to Mitigate CVE-2026-21716

Immediate Actions Required

• Review applications using Node.js Permission Model for FileHandle usage patterns
• Avoid using FileHandle.chmod() and FileHandle.chown() in permission-restricted environments until patched
• Consider using callback-based alternatives (fs.fchmod(), fs.fchown()) which have proper permission checks
• Update to patched Node.js versions as soon as they become available
• Implement additional application-level permission validation as a defense-in-depth measure

Patch Information

Node.js has released security updates addressing this vulnerability. Refer to the Node.js March 2026 Security Releases for patched versions and upgrade instructions.

Organizations should prioritize updating all Node.js installations running versions 20.x, 22.x, 24.x, and 25.x that utilize the Permission Model.

Workarounds

• Replace promise-based FileHandle.chmod() and FileHandle.chown() with callback-based fs.fchmod() and fs.fchown() which include proper permission checks
• Implement application-layer permission validation before invoking FileHandle methods
• Use operating system-level access controls (ACLs, SELinux, AppArmor) as additional protection layers
• Consider running untrusted code in isolated container environments with restricted filesystem access

# Example: Running Node.js with restricted permissions (use patched versions)
# Restrict filesystem write access while allowing specific paths
node --permission --allow-fs-read=* --allow-fs-write=/app/data app.js

# Verify Node.js version includes the security fix
node --version