Rafaelgss

A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process is not permitted to read. On macOS and Windows, fs.watch() and fs.promises.watch() in recursive mode are backed by the native libuv watcher: FSEventWrap::Start checks kFileSystemRead only once, on the watched root, and FSEventWrap::OnEvent then forwards every filename libuv reports (relative paths at any depth) to the JavaScript callback without checking that each path is covered by the read grant. Code running under --permission with an exact read grant on a directory can therefore learn names such as sub/secret.txt even though readdir on that subdirectory is denied. The flaw exposes names and timing metadata, not file contents, and requires macOS or Windows plus files created under the watched directory by another actor. This vulnerability affects Node.js 26.x, 24.x, and 22.x.

Uma falha no processamento de URL dentro do módulo `url` causa uma falha de asserção em código nativo. Isso ocorre quando a função `url.format()` é chamada com um nome de domínio internacionalizado (IDN) malformado contendo caracteres inválidos, o que leva ao travamento do processo do Node.js e pode ser explorado por um invasor remoto para causar a negação de serviço.

The use of the deprecated API `process.binding()` can bypass the permission model through path traversal, potentially allowing a remote attacker to bypass security restrictions and gain unauthorized access to protected information. This issue affects users of the experimental permission model in Node.js.

A flaw in the experimental permission model of Node.js version 20 allows malicious actors to retrieve stats from files they do not have explicit read access to when the --allow-fs-read flag is used with a non-* argument. This issue arises from an inadequate permission model that fails to restrict file stats through the `fs.statfs` API.