nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)

Overview

A flaw was found in the Node.js Permission Model. fs.realpathSync() does not perform the filesystem read permission checks required of comparable fs APIs. This is an incomplete fix of CVE-2026-21715, which only covered fs.realpathSync.native(). Code running under --permission with restricted --allow-fs-read can still use fs.realpathSync() to probe file existence, resolve symlink targets, and enumerate paths outside permitted directories, leading to information disclosure.

Vendor advisories

• Red Hat VEX · Low · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · updated 2026-10-26 · vex

nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() — rated Low by Red Hat. Released 2026-10-23, updated 2026-10-26.

Affected:

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9

No fix planned:

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9

Not affected:

• Red Hat Hardened Images

Remediation

Fix deferred

Workarounds / mitigations:

• If the Permission Model is unused, do not enable --permission. When --permission is required, avoid relying on fs.realpathSync() for security boundaries; use APIs that enforce permission checks and keep --allow-fs-read minimal (CME-1303: https://cmetaxonomy.org/entries/CME-1303.html). Apply OS-level confinement (SELinux, containers) as defense in depth (CME-301: https://cmetaxonomy.org/entries/CME-301.html; CME-702: https://cmetaxonomy.org/entries/CME-702.html).