{"id":"CVE-2024-22018","aliases":["ALPINE-CVE-2024-22018","ALSA-2024:5814","ALSA-2024:5815","AZL-43213","BELL-CVE-2024-22018","BIT-node-2024-22018","BIT-node-min-2024-22018","DEBIAN-CVE-2024-22018","EUVD-2024-19624","GHSA-9xvm-xmw3-2hm2","MGASA-2024-0282","OESA-2025-1199","OESA-2025-1200","RHSA-2024:5814","RHSA-2024:5815","RLSA-2024:5814","RLSA-2024:5815","SUSE-SU-2024:2543-1","SUSE-SU-2024:2574-1","UBUNTU-CVE-2024-22018","openSUSE-SU-2024:14214-1","openSUSE-SU-2024:14435-1","openSUSE-SU-2025:15802-1","openSUSE-SU-2026:11110-1"],"status":"published","title":"A vulnerability has been identified in Node.js, affecting users of the experimental permission...","description":"A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used.\nThis flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to.\nThis vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.","severity":{"version":"3.0","score":2.9,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00458,"percentile":0.39975,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2024-07-10T01:00:12Z","modified":"2026-11-02T12:00:43Z","fixes":[{"ecosystem":"Alpine:v3.19","package":"nodejs","fixed_in":["20.15.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"nodejs","fixed_in":["20.15.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"nodejs","fixed_in":["20.15.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"nodejs","fixed_in":["20.15.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nodejs","fixed_in":["20.15.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nodejs","fixed_in":["20.15.1-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"nodejs","fixed_in":["24.14.1-3"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"nodejs","fixed_in":["20.15.1-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"nodejs","fixed_in":["20.15.1-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node","fixed_in":["20.15.1","22.4.1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node-min","fixed_in":["20.18.1","22.12.0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nodejs","fixed_in":["20.15.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nodejs","fixed_in":["20.15.1+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.19","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module_el8.10.0+3882+e12e42db"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module_el8.10.0+3882+e12e42db"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module_el8.10.0+3882+e12e42db"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module_el8.10.0+3882+e12e42db"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1.module_el8.9.0+3731+490e3ce5"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.9.0+3775+d8460d35"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.9.0+3775+d8460d35"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.8.1-1.20.16.0.1.module_el8.10.0+3882+e12e42db"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module_el9.4.0+107+dbd477e4"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module_el9.4.0+107+dbd477e4"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module_el9.4.0+107+dbd477e4"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module_el9.4.0+107+dbd477e4"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1.module_el9.3.0+47+c33bc288"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el9.3.0+88+29afeaa2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el9.3.0+88+29afeaa2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.8.1-1.20.16.0.1.module_el9.4.0+107+dbd477e4"}]}],"bundled":3},{"source":"osv","ecosystem":"Azure Linux:3","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.14.1-3"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"20.9.0-r0"},{"fixed":"20.15.1-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"20.9.0-r0"},{"fixed":"20.15.1-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node","ranges":[{"type":"SEMVER","events":[{"introduced":"20.0.0"},{"fixed":"20.15.1"},{"introduced":"21.0.0"},{"fixed":"22.4.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node-min","ranges":[{"type":"SEMVER","events":[{"introduced":"20.0.0"},{"fixed":"20.18.1"},{"introduced":"21.0.0"},{"fixed":"22.12.0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.6.0-1.mga9"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:9","package":"yarnpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.22-0.10.8.2.1.mga9"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.18.2-1.oe2403"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.18.2-1.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module+el8.10.0+22203+a88c8310"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module+el8.10.0+22203+a88c8310"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module+el8.10.0+22203+a88c8310"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module+el8.10.0+22203+a88c8310"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module+el8.10.0+22203+a88c8310"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module+el8.10.0+22203+a88c8310"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.9.0+20473+c4e3d824"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.9.0+19519+e25b965a"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.9.0+19519+e25b965a"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.8.1-1.20.16.0.1.module+el8.10.0+22203+a88c8310"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module+el9.4.0+22197+9e60f127"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module+el9.4.0+22197+9e60f127"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module+el9.4.0+22197+9e60f127"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module+el9.4.0+22197+9e60f127"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module+el9.4.0+22197+9e60f127"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module+el9.4.0+22197+9e60f127"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.3.0.z+20478+84a9f781"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.3.0+19518+63aad52d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.3.0+19518+63aad52d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.8.1-1.20.16.0.1.module+el9.4.0+22197+9e60f127"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module+el8.10.0+1856+4cdb8df5"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1666+930e28e8"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1667+4a788d89"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32322+a8b1fd01"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.5.0+31770+0da7192d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32045+2e5d342d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32143+ae966e5b"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32144+1d29a396"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32185+bd121a25"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.5.0+31770+0da7192d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32045+2e5d342d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32048+5323bb50"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32143+ae966e5b"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32144+1d29a396"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32185+bd121a25"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32322+a8b1fd01"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP5","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-150500.11.12.2"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-150500.11.12.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP6","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-150600.3.3.2"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-150600.3.3.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.22.5~dfsg-5ubuntu1","12.22.7~dfsg-2ubuntu1","12.22.7~dfsg-2ubuntu3","12.22.9~dfsg-1ubuntu2","12.22.9~dfsg-1ubuntu3","12.22.9~dfsg-1ubuntu3.1","12.22.9~dfsg-1ubuntu3.2","12.22.9~dfsg-1ubuntu3.3","12.22.9~dfsg-1ubuntu3.4","12.22.9~dfsg-1ubuntu3.5","12.22.9~dfsg-1ubuntu3.6","12.22.9~dfsg-1ubuntu3.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["18.13.0+dfsg1-1ubuntu2","18.19.1+dfsg-2ubuntu4","18.19.1+dfsg-6ubuntu1","18.19.1+dfsg-6ubuntu2","18.19.1+dfsg-6ubuntu5"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.10.0-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.11.1-2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.3.1-1.1"}]}],"bundled":37}],"products":[{"vendor":"node.js","product":"node.js"},{"vendor":"nodejs","product":"node"}],"references":[{"url":"https://hackerone.com/reports/2145862","tags":["x_transferred","web","article","report"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/11/6","tags":["x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/19/3","tags":["x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20240816-0007/","tags":["web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-22018","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-9xvm-xmw3-2hm2"},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-22018","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:5814","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-22018","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-22020","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-28863","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-36137","tags":["report"]},{"url":"https://bugzilla.redhat.com/2293200","tags":["report"]},{"url":"https://bugzilla.redhat.com/2296417","tags":["report"]},{"url":"https://bugzilla.redhat.com/2296990","tags":["report"]},{"url":"https://bugzilla.redhat.com/2299281","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-5814.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:5815","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-5815.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-22018","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/advisories/BELL-SA-2024-43","tags":["advisory"]},{"url":"https://github.com/nodejs/node/releases/tag/v20.15.1","tags":["web"]},{"url":"https://github.com/nodejs/node/releases/tag/v22.4.1","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-22018","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0282.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33415","tags":["report"]},{"url":"https://github.com/nodejs/node/releases/tag/v22.6.0","tags":["web"]},{"url":"https://github.com/nodejs/node/releases/tag/v22.5.1","tags":["web"]},{"url":"https://github.com/nodejs/node/releases/tag/v22.5.0","tags":["web"]},{"url":"https://github.com/nodejs/node/releases/tag/v22.3.0","tags":["web"]},{"url":"https://github.com/nodejs/node/releases/tag/v22.2.0","tags":["web"]},{"url":"https://github.com/nodejs/node/releases/tag/v22.1.0","tags":["web"]},{"url":"https://github.com/nodejs/node/releases/tag/v22.0.0","tags":["web"]},{"url":"https://github.com/yarnpkg/yarn/releases/tag/v1.22.22","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1199","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-22020","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1200","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2293200","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2296417","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2296990","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2299281","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_5814.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-22018","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-22020","tags":["advisory"]},{"url":"https://hackerone.com/reports/2092749","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-28863","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-28863","tags":["advisory"]},{"url":"https://github.com/isaacs/node-tar/security/advisories/GHSA-f5x3-32g6-xq36","tags":["article"]},{"url":"https://security.netapp.com/advisory/ntap-20240524-0005/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-36137","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36137","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_5815.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:5814","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:5815","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242543-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1227554","tags":["report"]},{"url":"https://bugzilla.suse.com/1227560","tags":["report"]},{"url":"https://bugzilla.suse.com/1227561","tags":["report"]},{"url":"https://bugzilla.suse.com/1227562","tags":["report"]},{"url":"https://bugzilla.suse.com/1227563","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-37372","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242574-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-22018","tags":["report"]},{"url":"https://nodejs.org/en/blog/vulnerability/july-2024-security-releases#fslstat-bypasses-permission-model-cve-2024-22018---low","tags":["report"]},{"url":"https://github.com/nodejs/node/commit/b9289a6e29e54beeaa3f781bde1195e48df0da75","tags":["report"]},{"url":"https://github.com/nodejs/node/commit/4fe0f826a80365ce2512b8193ceaa9466c288aa5","tags":["report"]},{"url":"https://github.com/nodejs/node/commit/0881c1f01ac90006315cae5b9c38cfbf44d37e59","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OWCPL7VTEVIGUDVKLEV2D2ITNTWKC4AZ/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23083","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23165","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59464","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21716","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48936","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-22018","description":"A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used.\nThis flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to.\nThis vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.","status":"published","published":"2024-07-10T01:00:12.747Z","modified":"2025-04-30T22:25:19.795Z","cvss":[{"version":"3.0","score":2.9,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"updated_at":"2026-11-02T14:34:00.254134Z"}],"euvd":[{"id":"EUVD-2024-19624","description":"A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used.\nThis flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to.\nThis vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.","status":"published","published":"2024-07-10T01:00:12Z","modified":"2025-04-30T22:25:19Z","cvss":[{"version":"3.0","score":2.9,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T20:51:58.065214Z"}],"ghsa":[{"id":"GHSA-9xvm-xmw3-2hm2","title":"A vulnerability has been identified in Node.js, affecting users of the experimental permission...","description":"A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used.\nThis flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to.\nThis vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.","status":"published","published":"2024-07-10T03:30:35Z","modified":"2024-07-19T15:32:51Z","cvss":[{"version":"3.0","score":2.9,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T14:57:43.073604Z"}],"nvd":[{"id":"CVE-2024-22018","description":"A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used.\nThis flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to.\nThis vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.","status":"published","published":"2024-07-10T02:15:03.16Z","modified":"2026-06-17T07:10:32.943Z","cvss":[{"version":"3.0","score":2.9,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"}],"updated_at":"2026-11-02T14:10:12.016585Z"}],"osv":[{"id":"ALPINE-CVE-2024-22018","description":"A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used.\nThis flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to.\nThis vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.","status":"published","published":"2024-07-10T02:15:03.16Z","modified":"2026-11-02T11:17:50.069780475Z","cvss":[{"version":"3.0","score":2.9,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"BELL-CVE-2024-22018","status":"published","published":"2024-07-10T05:57:34.536914Z","modified":"2026-02-18T06:09:35.575394Z","cvss":[{"version":"3.0","score":2.9,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:28:19.288949Z"},{"id":"DEBIAN-CVE-2024-22018","description":"A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.","status":"published","published":"2024-07-10T02:15:03.16Z","modified":"2026-11-02T12:00:43.474178397Z","cvss":[{"version":"3.0","score":2.9,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"OESA-2025-1199","title":"nodejs security update","description":"Node.js is a platform built on Chrome\u0026amp;apos;s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.\r\n\r\nSecurity Fix(es):\n\nA vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used.\nThis flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to.\nThis vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.(CVE-2024-22018)\n\nA security flaw in Node.js  allows a bypass of network import restrictions.\nBy embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security.\nVerified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports.\nExploiting this flaw can violate network import security, posing a risk to developers and servers.(CVE-2024-22020)","status":"published","published":"2025-02-28T11:08:17Z","modified":"2026-08-18T01:18:48.145930911Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2025-1200","title":"nodejs security update","description":"Node.js is a platform built on Chrome\u0026amp;apos;s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.\r\n\r\nSecurity Fix(es):\n\nA vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used.\nThis flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to.\nThis vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.(CVE-2024-22018)\n\nA security flaw in Node.js  allows a bypass of network import restrictions.\nBy embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security.\nVerified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports.\nExploiting this flaw can violate network import security, posing a risk to developers and servers.(CVE-2024-22020)","status":"published","published":"2025-02-28T11:08:17Z","modified":"2026-08-18T01:18:48.140854716Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"RHSA-2024:5814","title":"Red Hat Security Advisory: nodejs:20 security update","status":"published","published":"2024-10-22T02:23:52Z","modified":"2026-10-14T10:04:48Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RHSA-2024:5815","title":"Red Hat Security Advisory: nodejs:20 security update","status":"published","published":"2024-09-16T20:58:42Z","modified":"2026-03-18T11:36:08.436504Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RLSA-2024:5815","title":"Moderate: nodejs:20 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Bypass network import restriction via data URL (CVE-2024-22020)\n\n* nodejs: fs.lstat bypasses permission model (CVE-2024-22018)\n\n* nodejs: fs.fchown/fchmod bypasses permission model (CVE-2024-36137)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-09-17T00:55:59.307259Z","modified":"2025-10-09T05:47:31.486054Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"UBUNTU-CVE-2024-22018","description":"A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.","status":"published","published":"2024-07-10T02:15:00Z","modified":"2026-04-22T14:39:54.072297Z","cvss":[{"version":"3.0","score":2.9,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T16:54:42.68848Z"},{"id":"ALSA-2024:5814","title":"Moderate: nodejs:20 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* node-tar: denial of service while parsing a tar file due to lack of folders depth validation (CVE-2024-28863)\n* nodejs: Bypass network import restriction via data URL (CVE-2024-22020)\n* nodejs: fs.lstat bypasses permission model (CVE-2024-22018)\n* nodejs: fs.fchown/fchmod bypasses permission model (CVE-2024-36137)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-08-26T00:00:00Z","modified":"2026-10-29T11:02:21.716295163Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2024:5815","title":"Moderate: nodejs:20 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Bypass network import restriction via data URL (CVE-2024-22020)\n* nodejs: fs.lstat bypasses permission model (CVE-2024-22018)\n* nodejs: fs.fchown/fchmod bypasses permission model (CVE-2024-36137)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-08-26T00:00:00Z","modified":"2026-10-29T11:31:49.752264068Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"AZL-43213","title":"CVE-2024-22018 affecting package nodejs for versions less than 24.14.1-3","description":"A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used.\nThis flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to.\nThis vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.","status":"published","published":"2024-07-10T02:15:03Z","modified":"2026-08-28T17:46:07.003426611Z","updated_at":"2026-11-02T15:28:05.284713Z"},{"id":"BIT-node-2024-22018","description":"A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used.\nThis flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to.\nThis vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.","status":"published","published":"2024-07-12T07:29:02.117Z","modified":"2026-02-11T09:32:42.679179Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"BIT-node-min-2024-22018","description":"A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used.\nThis flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to.\nThis vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.","status":"published","published":"2024-12-16T13:54:54.315Z","modified":"2026-02-11T09:32:42.320641Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"CVE-2024-22018","description":"A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used.\nThis flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to.\nThis vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.","status":"published","published":"2024-07-10T02:15:03Z","modified":"2026-06-24T09:14:43.42438457Z","updated_at":"2026-11-02T15:44:38.577405Z"},{"id":"MGASA-2024-0282","title":"Updated nodejs \u0026 yarnpkg packages fix security vulnerabilities","description":"Nodejs 22 is the new active LTS branch and 5 CVE are fixed.\nCVE-2024-36138 - Bypass incomplete fix of CVE-2024-27980 (High)\nCVE-2024-22020 - Bypass network import restriction via data URL (Medium)\nCVE-2024-22018 - fs.lstat bypasses permission model (Low)\nCVE-2024-36137 - fs.fchown/fchmod bypasses permission model (Low)\nCVE-2024-37372 - Permission model improperly processes UNC paths (Low)\nyarn package is updated with npm 10.8.2\n","status":"published","published":"2024-08-28T17:11:44Z","modified":"2026-04-16T04:40:55.567077754Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:14214-1","title":"corepack20-20.15.1-1.1 on GA media","description":"These are all security issues fixed in the corepack20-20.15.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-22T00:00:00Z","modified":"2026-02-04T02:56:34.982757Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2024:14435-1","title":"corepack22-22.10.0-1.1 on GA media","description":"These are all security issues fixed in the corepack22-22.10.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-10-29T00:00:00Z","modified":"2026-02-04T02:15:17.587107Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2025:15802-1","title":"corepack24-24.11.1-2.1 on GA media","description":"These are all security issues fixed in the corepack24-24.11.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-12-08T00:00:00Z","modified":"2026-03-23T04:54:11.929189Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:11110-1","title":"nodejs26-26.3.1-1.1 on GA media","description":"These are all security issues fixed in the nodejs26-26.3.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-23T00:00:00Z","modified":"2026-06-24T09:00:19.692832432Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"RLSA-2024:5814","title":"Moderate: nodejs:20 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* node-tar: denial of service while parsing a tar file due to lack of folders depth validation (CVE-2024-28863)\n\n* nodejs: Bypass network import restriction via data URL (CVE-2024-22020)\n\n* nodejs: fs.lstat bypasses permission model (CVE-2024-22018)\n\n* nodejs: fs.fchown/fchmod bypasses permission model (CVE-2024-36137)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-09-17T00:54:54.665652Z","modified":"2026-02-04T07:40:20.112683Z","updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"SUSE-SU-2024:2543-1","title":"Security update for nodejs20","description":"This update for nodejs20 fixes the following issues:\n\nUpdate to 20.15.1:\n\n- CVE-2024-36138: Fixed CVE-2024-27980 fix bypass (bsc#1227560)\n- CVE-2024-22020: Fixed a bypass of network import restriction via data URL (bsc#1227554)\n- CVE-2024-22018: Fixed fs.lstat bypasses permission model (bsc#1227562)\n- CVE-2024-36137: Fixed fs.fchown/fchmod bypasses permission model (bsc#1227561)\n- CVE-2024-37372: Fixed Permission model improperly processes UNC paths (bsc#1227563)\n\nChanges in 20.15.0:\n\n- test_runner: support test plans\n- inspector: introduce the --inspect-wait flag\n- zlib: expose zlib.crc32()\n- cli: allow running wasm in limited vmem with --disable-wasm-trap-handler\n\nChanges in 20.14.0\n\n- src,permission: throw async errors on async APIs\n- test_runner: support forced exit\n\nChanges in 20.13.1:\n\n- buffer: improve base64 and base64url performance\n- crypto: deprecate implicitly shortened GCM tags\n- events,doc: mark CustomEvent as stable\n- fs: add stacktrace to fs/promises\n- report: add --report-exclude-network option\n- src: add uv_get_available_memory to report and process\n- stream: support typed arrays\n- util: support array of formats in util.styleText\n- v8: implement v8.queryObjects() for memory leak regression testing\n- watch: mark as stable\n","status":"published","published":"2024-07-17T07:51:52Z","modified":"2026-02-04T03:44:28.883947Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:2574-1","title":"Security update for nodejs20","description":"This update for nodejs20 fixes the following issues:\n\nUpdate to 20.15.1:\n\n- CVE-2024-36138: Fixed CVE-2024-27980 fix bypass (bsc#1227560)\n- CVE-2024-22020: Fixed a bypass of network import restriction via data URL (bsc#1227554)\n- CVE-2024-22018: Fixed fs.lstat bypasses permission model (bsc#1227562)\n- CVE-2024-36137: Fixed fs.fchown/fchmod bypasses permission model (bsc#1227561)\n- CVE-2024-37372: Fixed Permission model improperly processes UNC paths (bsc#1227563)\n\nChanges in 20.15.0:\n\n- test_runner: support test plans\n- inspector: introduce the --inspect-wait flag\n- zlib: expose zlib.crc32()\n- cli: allow running wasm in limited vmem with --disable-wasm-trap-handler\n\nChanges in 20.14.0\n\n- src,permission: throw async errors on async APIs\n- test_runner: support forced exit\n\nChanges in 20.13.1:\n\n- buffer: improve base64 and base64url performance\n- crypto: deprecate implicitly shortened GCM tags\n- events,doc: mark CustomEvent as stable\n- fs: add stacktrace to fs/promises\n- report: add --report-exclude-network option\n- src: add uv_get_available_memory to report and process\n- stream: support typed arrays\n- util: support array of formats in util.styleText\n- v8: implement v8.queryObjects() for memory leak regression testing\n- watch: mark as stable\n","status":"published","published":"2024-07-22T10:35:15Z","modified":"2026-02-04T03:46:39.426759Z","updated_at":"2026-11-02T15:53:55.136363Z"}]}}