CVE-2024-21890
Fixed in a distro release EPSS <1%CVSS 5.0
The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. For example: ``` --allow-fs-read=/home/node/.ssh/*.pub ``` will ignore `pub` and give access to everything after `.ssh/`. This misleading documentation affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
Products: NodeJS Node
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | nodejs | 1:20.11.1-1.module_el8.9.0+3775+d8460d35 |
| AlmaLinux 8 | nodejs-devel | 1:20.11.1-1.module_el8.9.0+3775+d8460d35 |
| AlmaLinux 8 | nodejs-docs | 1:20.11.1-1.module_el8.9.0+3775+d8460d35 |
| AlmaLinux 8 | nodejs-full-i18n | 1:20.11.1-1.module_el8.9.0+3775+d8460d35 |
| AlmaLinux 8 | nodejs-nodemon | 3.0.1-1.module_el8.9.0+3731+490e3ce5 |
| AlmaLinux 8 | nodejs-packaging | 2021.06-4.module_el8.9.0+3684+11b9e959 |
| AlmaLinux 8 | nodejs-packaging-bundler | 2021.06-4.module_el8.9.0+3684+11b9e959 |
| AlmaLinux 8 | npm | 1:10.2.4-1.20.11.1.1.module_el8.9.0+3775+d8460d35 |
| AlmaLinux 9 | nodejs | 1:20.11.1-1.module_el9.3.0+88+29afeaa2 |
| AlmaLinux 9 | nodejs-devel | 1:20.11.1-1.module_el9.3.0+88+29afeaa2 |
| AlmaLinux 9 | nodejs-docs | 1:20.11.1-1.module_el9.3.0+88+29afeaa2 |
| AlmaLinux 9 | nodejs-full-i18n | 1:20.11.1-1.module_el9.3.0+88+29afeaa2 |
| AlmaLinux 9 | nodejs-nodemon | 3.0.1-1.module_el9.3.0+47+c33bc288 |
| AlmaLinux 9 | nodejs-packaging | 2021.06-4.module_el9.3.0+48+1cf146a1 |
| AlmaLinux 9 | nodejs-packaging-bundler | 2021.06-4.module_el9.3.0+48+1cf146a1 |
| AlmaLinux 9 | npm | 1:10.2.4-1.20.11.1.1.module_el9.3.0+88+29afeaa2 |
| Chainguard | nodejs-16 | 16.20.2-r11 |
| Chainguard | nodejs-16-doc | 16.20.2-r11 |
| Chainguard | nodejs-18 | 0 |
| Chainguard | nodejs-18-doc | 0 |
| Red Hat Enterprise Linux 8 | nodejs | 1:20.11.1-1.module+el8.9.0+21380+12032667 |
| Red Hat Enterprise Linux 8 | nodejs-debuginfo | 1:20.11.1-1.module+el8.9.0+21380+12032667 |
| Red Hat Enterprise Linux 8 | nodejs-debugsource | 1:20.11.1-1.module+el8.9.0+21380+12032667 |
| Red Hat Enterprise Linux 8 | nodejs-devel | 1:20.11.1-1.module+el8.9.0+21380+12032667 |
| Red Hat Enterprise Linux 8 | nodejs-docs | 1:20.11.1-1.module+el8.9.0+21380+12032667 |
| Red Hat Enterprise Linux 8 | nodejs-full-i18n | 1:20.11.1-1.module+el8.9.0+21380+12032667 |
| Red Hat Enterprise Linux 8 | nodejs-nodemon | 0:3.0.1-1.module+el8.9.0+20473+c4e3d824 |
| Red Hat Enterprise Linux 8 | nodejs-packaging | 0:2021.06-4.module+el8.9.0+19519+e25b965a |
| Red Hat Enterprise Linux 8 | nodejs-packaging-bundler | 0:2021.06-4.module+el8.9.0+19519+e25b965a |
| Red Hat Enterprise Linux 8 | npm | 1:10.2.4-1.20.11.1.1.module+el8.9.0+21380+12032667 |
| Red Hat Enterprise Linux 9 | nodejs | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| Red Hat Enterprise Linux 9 | nodejs-debuginfo | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| Red Hat Enterprise Linux 9 | nodejs-debugsource | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| Red Hat Enterprise Linux 9 | nodejs-devel | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| Red Hat Enterprise Linux 9 | nodejs-docs | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| Red Hat Enterprise Linux 9 | nodejs-full-i18n | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| Red Hat Enterprise Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.3.0.z+20478+84a9f781 |
| Red Hat Enterprise Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.3.0+19518+63aad52d |
| Red Hat Enterprise Linux 9 | nodejs-packaging-bundler | 0:2021.06-4.module+el9.3.0+19518+63aad52d |
| Red Hat Enterprise Linux 9 | npm | 1:10.2.4-1.20.11.1.1.module+el9.3.0+21385+bac43d5a |
| Rocky Linux 8 | nodejs | 1:20.11.1-1.module+el8.9.0+1776+addd4aec |
| Rocky Linux 8 | nodejs-nodemon | 0:3.0.1-1.module+el8.8.0+1459+02651ab6 |
| Rocky Linux 8 | nodejs-packaging | 0:2021.06-4.module+el8.7.0+1072+5b168780 |
| Rocky Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32185+bd121a25 |
| Rocky Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32144+1d29a396 |
| Rocky Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32143+ae966e5b |
| Rocky Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32045+2e5d342d |
| Rocky Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.5.0+31770+0da7192d |
| Rocky Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32322+a8b1fd01 |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32048+5323bb50 |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.5.0+31770+0da7192d |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32322+a8b1fd01 |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32185+bd121a25 |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32144+1d29a396 |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32143+ae966e5b |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32045+2e5d342d |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP5 | nodejs20 | 20.11.1-150500.11.6.1 |
| Ubuntu 25.10 | nodejs | no fix |
| Ubuntu 26.04 LTS | nodejs | no fix |
| Ubuntu 26.10 | nodejs | no fix |
| Wolfi | nodejs-16 | 16.20.2-r11 |
| Wolfi | nodejs-16-doc | 16.20.2-r11 |
| Wolfi | nodejs-18 | 0 |
| Wolfi | nodejs-18-doc | 0 |
| openSUSE Leap 15.5 | nodejs20 | 20.11.1-150500.11.6.1 |
| openSUSE Tumbleweed | nodejs20 | 20.11.1-1.1 |
| openSUSE Tumbleweed | nodejs21 | 21.6.2-1.1 |