Sy2N0

**Name of the Vulnerable Software and Affected Versions** Node.js versions 22.x Node.js versions 24.x Node.js versions 26.x Node.js main **Description** A flaw in the Permission Model enforcement allows for the over-granting of filesystem access across radix-tree prefix boundaries. When the `--permission` flag is used, an attacker granted access to a specific path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. A radix-tree is a space-optimized trie data structure used for efficient searching of keys, in this case, filesystem paths. **Recommendations** Update Node.js 22.x to the latest patched version. Update Node.js 24.x to version 24.18.1-1.1 or newer. Update Node.js 26.x to version 26.5.1-1.1 or newer. Update Node.js main to the latest patched version.

**Name of the Vulnerable Software and Affected Versions** Node Version Manager (nvm) versions 0.32.1 through 0.40.5 **Description** An issue exists where `nvm ls-remote` and other commands that refresh remote LTS aliases, such as `nvm install --lts`, parse the node.js mirror's `index.tab` and use the LTS codename field as an alias filename without validation. A compromised mirror or a man-in-the-middle attack can return an LTS codename containing path-traversal sequences, such as `../../../.bashrc`. This allows the software to write version strings to paths outside the `$NVM DIR/alias` directory. In default configurations where `$NVM DIR` is `~/.nvm`, this can result in the creation or overwriting of files in the user's home directory, including shell startup files, potentially leading to code execution in subsequent shell sessions. Exploitation requires the use of a hostile mirror via a compromised CDN, network man-in-the-middle, or a malicious configuration of the `NVM NODEJS ORG MIRROR` or `NVM IOJS ORG MIRROR` variables. **Recommendations** Update to version 0.40.6.