CVE-2026-21716

Name of the Vulnerable Software and Affected Versions Node.js versions 20.x through 25.x

Description An incomplete fix allows bypassing of intended write restrictions when using the Permission Model with restricted --allow-fs-write. Specifically, the FileHandle.chmod() and FileHandle.chown() methods within the promises API lack the necessary permission checks, while their callback-based counterparts (fs.fchmod(), fs.fchown()) were patched correctly. This allows code running with restricted permissions to modify file permissions and ownership on already-open file descriptors. The vulnerable API endpoints are FileHandle.chmod() and FileHandle.chown(). The vulnerable variables are file permissions and ownership.

Recommendations Update to a version beyond 25.x when available.