Rafaelgss

A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process is not permitted to read. On macOS and Windows, fs.watch() and fs.promises.watch() in recursive mode are backed by the native libuv watcher: FSEventWrap::Start checks kFileSystemRead only once, on the watched root, and FSEventWrap::OnEvent then forwards every filename libuv reports (relative paths at any depth) to the JavaScript callback without checking that each path is covered by the read grant. Code running under --permission with an exact read grant on a directory can therefore learn names such as sub/secret.txt even though readdir on that subdirectory is denied. The flaw exposes names and timing metadata, not file contents, and requires macOS or Windows plus files created under the watched directory by another actor. This vulnerability affects Node.js 26.x, 24.x, and 22.x.

يؤدي خلل في معالجة عناوين URL داخل الوحدة النمطية `url` إلى حدوث خطأ في التحقق من الصحة في الكود الأصلي. يحدث هذا عند استدعاء الدالة `url.format()` باستخدام اسم نطاق دولي (IDN) غير صحيح يحتوي على أحرف غير صالحة، مما يؤدي إلى توقف عملية Node.js ويمكن استغلاله من قبل مهاجم عن بُعد للتسبب في رفض الخدمة.

The use of the deprecated API `process.binding()` can bypass the permission model through path traversal, potentially allowing a remote attacker to bypass security restrictions and gain unauthorized access to protected information. This issue affects users of the experimental permission model in Node.js.

A flaw in the experimental permission model of Node.js version 20 allows malicious actors to retrieve stats from files they do not have explicit read access to when the --allow-fs-read flag is used with a non-* argument. This issue arises from an inadequate permission model that fails to restrict file stats through the `fs.statfs` API.