Read the docs
TI-2024-14551 Aliases CVE-2024-21890GHSA-m27w-wvc9-v4mq

The Node.js Permission Model does not clarify in the documentation that wildcards should…

Priority LOW 31Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. For example: ``` --allow-fs-read=/home/node/.ssh/*.pub ``` will ignore `pub` and give access to everything after `.ssh/`. This misleading documentation affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00945 61st percentileScored 2026-11-07
Fix Fixed Node (NodeJS): 20.11.1, 21.6.2Red Hat: 2 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NodeJSNode4.0 and later; 5.0 and later; 6.0 and later; 7.0 and later; 8.0 and later; 9.0 and later; 10.0 and later; 11.0 and later; 12.0 and later; 13.0 and later; 14.0 and later; 15.0 and later; 16.0 and later; 17.0 and later; 19.0 and later; 20.0 to before 20.11.1; 21.0 to before 21.6.220.11.1, 21.6.2Patch availableCNA
  • Node VendorNodeJS Affected 4.0 and later; 5.0 and later; 6.0 and later; 7.0 and later; 8.0 and later; 9.0 and later; 10.0 and later; 11.0 and later; 12.0 and later; 13.0 and later; 14.0 and later; 15.0 and later; 16.0 and later; 17.0 and later; 19.0 and later; 20.0 to before 20.11.1; 21.0 to before 21.6.2 Fixed in 20.11.1, 21.6.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*20.0.0 to before 20.11.1; 21.0.0 to before 21.6.2VulnerableNodeJS
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* Versions 20.0.0 to before 20.11.1; 21.0.0 to before 21.6.2 Vulnerable ·NodeJS

Remediation

  • Fix · CNA Node (NodeJS) Fixed in 20.11.1, 21.6.2

Red Hat 2 advisories

  • RHSA-2024:1687 Released 2024-04-08 · Red Hat rating Important
    nodejs:20 security update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:20.11.1-1.module+el8.9.0+21380+12032667.aarch64::nodejs:20, nodejs-1:20.11.1-1.module+el8.9.0+21380+12032667.ppc64le::nodejs:20, nodejs-1:20.11.1-1.module+el8.9.0+21380+12032667.s390x::nodejs:20 +20
  • RHSA-2024:1688 Released 2024-04-08 · Red Hat rating Important
    nodejs:20 security update
    • Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:20.11.1-1.module+el9.3.0+21385+bac43d5a.aarch64::nodejs:20, nodejs-1:20.11.1-1.module+el9.3.0+21385+bac43d5a.ppc64le::nodejs:20, nodejs-1:20.11.1-1.module+el9.3.0+21385+bac43d5a.s390x::nodejs:20 +20

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    NodeJS Node 10.*, 11.* and 15 more versions

    3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2024-14556 The permission model protects itself against path traversal attacks by calling…Priority MEDIUM 45
    • TI-2024-14552 Path traversal in NodeJS NodePriority MEDIUM 43
    Show all 3 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2024:1687
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:1688
Not affected: 2 products
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-21890
  2. 2026-10-03 Alias added: GHSA-m27w-wvc9-v4mq

References

Advisory 3

  • TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2016-01993 The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other… CVSS 3.1HIGH 7.5
  • TI-2024-03325 Command injection vulnerability in programing languages on Microsoft Windows operating system. CVSS 3.1CRITICAL 9.8
  • TI-2022-03472 X.509 Email Address Variable Length Buffer Overflow CVSS 3.1HIGH 7.5
  • TI-2022-03315 X.509 Email Address 4-byte Buffer Overflow CVSS 3.1HIGH 7.5
See all 186 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences