CVE-2024-36137
Fixed in a distro release EPSS <1%CVSS 3.3
A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used. Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a "read-only" file descriptor to change the owner and permissions of a file.
Products: NodeJS Node
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | nodejs | 1:20.16.0-1.module_el8.10.0+3882+e12e42db |
| AlmaLinux 8 | nodejs-devel | 1:20.16.0-1.module_el8.10.0+3882+e12e42db |
| AlmaLinux 8 | nodejs-docs | 1:20.16.0-1.module_el8.10.0+3882+e12e42db |
| AlmaLinux 8 | nodejs-full-i18n | 1:20.16.0-1.module_el8.10.0+3882+e12e42db |
| AlmaLinux 8 | nodejs-nodemon | 3.0.1-1.module_el8.9.0+3731+490e3ce5 |
| AlmaLinux 8 | nodejs-packaging | 2021.06-4.module_el8.9.0+3775+d8460d35 |
| AlmaLinux 8 | nodejs-packaging-bundler | 2021.06-4.module_el8.9.0+3775+d8460d35 |
| AlmaLinux 8 | npm | 1:10.8.1-1.20.16.0.1.module_el8.10.0+3882+e12e42db |
| AlmaLinux 9 | nodejs | 1:20.16.0-1.module_el9.4.0+107+dbd477e4 |
| AlmaLinux 9 | nodejs-devel | 1:20.16.0-1.module_el9.4.0+107+dbd477e4 |
| AlmaLinux 9 | nodejs-docs | 1:20.16.0-1.module_el9.4.0+107+dbd477e4 |
| AlmaLinux 9 | nodejs-full-i18n | 1:20.16.0-1.module_el9.4.0+107+dbd477e4 |
| AlmaLinux 9 | nodejs-nodemon | 3.0.1-1.module_el9.3.0+47+c33bc288 |
| AlmaLinux 9 | nodejs-packaging | 2021.06-4.module_el9.3.0+88+29afeaa2 |
| AlmaLinux 9 | nodejs-packaging-bundler | 2021.06-4.module_el9.3.0+88+29afeaa2 |
| AlmaLinux 9 | npm | 1:10.8.1-1.20.16.0.1.module_el9.4.0+107+dbd477e4 |
| Alpine 3.19 | nodejs | 20.15.1-r0 |
| Alpine 3.20 | nodejs | 20.15.1-r0 |
| Alpine 3.21 | nodejs | 20.15.1-r0 |
| Alpine 3.22 | nodejs | 20.15.1-r0 |
| Alpine 3.23 | nodejs | 20.15.1-r0 |
| Alpine 3.24 | nodejs | 20.15.1-r0 |
| Chainguard | nodejs-21 | no fix |
| Chainguard | nodejs-21-doc | 21.7.3-r13 |
| Debian 13 | nodejs | 20.15.1+dfsg-1 |
| Debian 14 | nodejs | 20.15.1+dfsg-1 |
| Red Hat Enterprise Linux 8 | nodejs | 1:20.16.0-1.module+el8.10.0+22203+a88c8310 |
| Red Hat Enterprise Linux 8 | nodejs-debuginfo | 1:20.16.0-1.module+el8.10.0+22203+a88c8310 |
| Red Hat Enterprise Linux 8 | nodejs-debugsource | 1:20.16.0-1.module+el8.10.0+22203+a88c8310 |
| Red Hat Enterprise Linux 8 | nodejs-devel | 1:20.16.0-1.module+el8.10.0+22203+a88c8310 |
| Red Hat Enterprise Linux 8 | nodejs-docs | 1:20.16.0-1.module+el8.10.0+22203+a88c8310 |
| Red Hat Enterprise Linux 8 | nodejs-full-i18n | 1:20.16.0-1.module+el8.10.0+22203+a88c8310 |
| Red Hat Enterprise Linux 8 | nodejs-nodemon | 0:3.0.1-1.module+el8.9.0+20473+c4e3d824 |
| Red Hat Enterprise Linux 8 | nodejs-packaging | 0:2021.06-4.module+el8.9.0+19519+e25b965a |
| Red Hat Enterprise Linux 8 | nodejs-packaging-bundler | 0:2021.06-4.module+el8.9.0+19519+e25b965a |
| Red Hat Enterprise Linux 8 | npm | 1:10.8.1-1.20.16.0.1.module+el8.10.0+22203+a88c8310 |
| Red Hat Enterprise Linux 9 | nodejs | 1:20.16.0-1.module+el9.4.0+22197+9e60f127 |
| Red Hat Enterprise Linux 9 | nodejs-debuginfo | 1:20.16.0-1.module+el9.4.0+22197+9e60f127 |
| Red Hat Enterprise Linux 9 | nodejs-debugsource | 1:20.16.0-1.module+el9.4.0+22197+9e60f127 |
| Red Hat Enterprise Linux 9 | nodejs-devel | 1:20.16.0-1.module+el9.4.0+22197+9e60f127 |
| Red Hat Enterprise Linux 9 | nodejs-docs | 1:20.16.0-1.module+el9.4.0+22197+9e60f127 |
| Red Hat Enterprise Linux 9 | nodejs-full-i18n | 1:20.16.0-1.module+el9.4.0+22197+9e60f127 |
| Red Hat Enterprise Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.3.0.z+20478+84a9f781 |
| Red Hat Enterprise Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.3.0+19518+63aad52d |
| Red Hat Enterprise Linux 9 | nodejs-packaging-bundler | 0:2021.06-4.module+el9.3.0+19518+63aad52d |
| Red Hat Enterprise Linux 9 | npm | 1:10.8.1-1.20.16.0.1.module+el9.4.0+22197+9e60f127 |
| Rocky Linux 8 | nodejs | 1:20.16.0-1.module+el8.10.0+1856+4cdb8df5 |
| Rocky Linux 8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1666+930e28e8 |
| Rocky Linux 8 | nodejs-packaging | 0:2021.06-4.module+el8.10.0+1667+4a788d89 |
| Rocky Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32143+ae966e5b |
| Rocky Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32322+a8b1fd01 |
| Rocky Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.5.0+31770+0da7192d |
| Rocky Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32045+2e5d342d |
| Rocky Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32144+1d29a396 |
| Rocky Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32185+bd121a25 |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.5.0+31770+0da7192d |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32045+2e5d342d |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32322+a8b1fd01 |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32185+bd121a25 |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32144+1d29a396 |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32143+ae966e5b |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32048+5323bb50 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP5 | nodejs20 | 20.15.1-150500.11.12.2 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP6 | nodejs20 | 20.15.1-150600.3.3.2 |
| Ubuntu 25.04 | nodejs | 20.16.0+dfsg-1ubuntu1 |
| Wolfi | nodejs-21 | no fix |
| Wolfi | nodejs-21-doc | 21.7.3-r13 |
| openSUSE Leap 15.5 | nodejs20 | 20.15.1-150500.11.12.2 |
| openSUSE Leap 15.6 | nodejs20 | 20.15.1-150600.3.3.2 |
| openSUSE Tumbleweed | nodejs20 | 20.15.1-1.1 |
| openSUSE Tumbleweed | nodejs22 | 22.10.0-1.1 |
| openSUSE Tumbleweed | nodejs24 | 24.11.1-2.1 |
| openSUSE Tumbleweed | nodejs26 | 26.3.1-1.1 |