{"id":"CVE-2024-36137","aliases":["ALPINE-CVE-2024-36137","ALSA-2024:5814","ALSA-2024:5815","AZL-48849","BELL-CVE-2024-36137","BIT-node-2024-36137","BIT-node-min-2024-36137","DEBIAN-CVE-2024-36137","EUVD-2024-36333","GHSA-q793-mj5v-wh68","MGASA-2024-0282","OESA-2025-1519","OESA-2025-1520","RHSA-2024:5814","RHSA-2024:5815","RLSA-2024:5814","RLSA-2024:5815","SUSE-SU-2024:2543-1","SUSE-SU-2024:2574-1","UBUNTU-CVE-2024-36137","openSUSE-SU-2024:14214-1","openSUSE-SU-2024:14435-1","openSUSE-SU-2025:15802-1","openSUSE-SU-2026:11110-1"],"status":"published","title":"A vulnerability has been identified in Node.js, affecting users of the experimental permission...","description":"A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used.\r\n\r\nNode.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a \"read-only\" file descriptor to change the owner and permissions of a file.","severity":{"version":"3.0","score":3.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00395,"percentile":0.34021,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2024-07-12T05:58:28.56548Z","modified":"2026-11-02T12:02:34Z","fixes":[{"ecosystem":"Alpine:v3.19","package":"nodejs","fixed_in":["20.15.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"nodejs","fixed_in":["20.15.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"nodejs","fixed_in":["20.15.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"nodejs","fixed_in":["20.15.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nodejs","fixed_in":["20.15.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nodejs","fixed_in":["20.15.1-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"nodejs","fixed_in":["24.14.1-3"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"nodejs","fixed_in":["20.15.1-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"nodejs","fixed_in":["20.15.1-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node","fixed_in":["20.15.1","22.4.1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node-min","fixed_in":["20.18.1","22.12.0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nodejs","fixed_in":["20.15.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nodejs","fixed_in":["20.15.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"nodejs","fixed_in":["20.18.2-2.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"nodejs","fixed_in":["20.18.2-2.oe2403sp1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.19","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module_el8.10.0+3882+e12e42db"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module_el8.10.0+3882+e12e42db"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module_el8.10.0+3882+e12e42db"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module_el8.10.0+3882+e12e42db"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1.module_el8.9.0+3731+490e3ce5"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.9.0+3775+d8460d35"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.9.0+3775+d8460d35"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.8.1-1.20.16.0.1.module_el8.10.0+3882+e12e42db"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module_el9.4.0+107+dbd477e4"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module_el9.4.0+107+dbd477e4"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module_el9.4.0+107+dbd477e4"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module_el9.4.0+107+dbd477e4"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1.module_el9.3.0+47+c33bc288"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el9.3.0+88+29afeaa2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el9.3.0+88+29afeaa2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.8.1-1.20.16.0.1.module_el9.4.0+107+dbd477e4"}]}],"bundled":3},{"source":"osv","ecosystem":"Azure Linux:3","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.14.1-3"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"20.9.0-r0"},{"fixed":"20.15.1-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"20.9.0-r0"},{"fixed":"20.15.1-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node","ranges":[{"type":"SEMVER","events":[{"introduced":"20.0.0"},{"fixed":"20.15.1"},{"introduced":"21.0.0"},{"fixed":"22.4.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node-min","ranges":[{"type":"SEMVER","events":[{"introduced":"20.0.0"},{"fixed":"20.18.1"},{"introduced":"21.0.0"},{"fixed":"22.12.0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.6.0-1.mga9"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:9","package":"yarnpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.22-0.10.8.2.1.mga9"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.18.2-2.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.18.2-2.oe2403sp1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module+el8.10.0+22203+a88c8310"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module+el8.10.0+22203+a88c8310"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module+el8.10.0+22203+a88c8310"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module+el8.10.0+22203+a88c8310"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module+el8.10.0+22203+a88c8310"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module+el8.10.0+22203+a88c8310"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.9.0+20473+c4e3d824"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.9.0+19519+e25b965a"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.9.0+19519+e25b965a"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.8.1-1.20.16.0.1.module+el8.10.0+22203+a88c8310"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module+el9.4.0+22197+9e60f127"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module+el9.4.0+22197+9e60f127"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module+el9.4.0+22197+9e60f127"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module+el9.4.0+22197+9e60f127"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module+el9.4.0+22197+9e60f127"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module+el9.4.0+22197+9e60f127"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.3.0.z+20478+84a9f781"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.3.0+19518+63aad52d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.3.0+19518+63aad52d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.8.1-1.20.16.0.1.module+el9.4.0+22197+9e60f127"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module+el8.10.0+1856+4cdb8df5"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1666+930e28e8"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1667+4a788d89"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32322+a8b1fd01"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.5.0+31770+0da7192d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32045+2e5d342d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32143+ae966e5b"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32144+1d29a396"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32185+bd121a25"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.5.0+31770+0da7192d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32045+2e5d342d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32048+5323bb50"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32143+ae966e5b"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32144+1d29a396"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32185+bd121a25"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32322+a8b1fd01"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP5","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-150500.11.12.2"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-150500.11.12.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP6","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-150600.3.3.2"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-150600.3.3.2"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.10.0-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.11.1-2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.3.1-1.1"}]}],"bundled":37}],"products":[{"vendor":"nodejs","product":"node"}],"references":[{"url":"https://nodejs.org/en/blog/vulnerability/july-2024-security-releases","tags":["web","article"]},{"url":"https://security.netapp.com/advisory/ntap-20241122-0005/","tags":["web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36137","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20241122-0005"},{"url":"https://github.com/advisories/GHSA-q793-mj5v-wh68"},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-36137","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:5814","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-22018","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-22020","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-28863","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-36137","tags":["report"]},{"url":"https://bugzilla.redhat.com/2293200","tags":["report"]},{"url":"https://bugzilla.redhat.com/2296417","tags":["report"]},{"url":"https://bugzilla.redhat.com/2296990","tags":["report"]},{"url":"https://bugzilla.redhat.com/2299281","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-5814.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:5815","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-5815.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-36137","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/advisories/BELL-SA-2024-43","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-36137","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0282.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33415","tags":["report"]},{"url":"https://github.com/nodejs/node/releases/tag/v22.6.0","tags":["web"]},{"url":"https://github.com/nodejs/node/releases/tag/v22.5.1","tags":["web"]},{"url":"https://github.com/nodejs/node/releases/tag/v22.5.0","tags":["web"]},{"url":"https://github.com/nodejs/node/releases/tag/v22.4.1","tags":["web"]},{"url":"https://github.com/nodejs/node/releases/tag/v22.3.0","tags":["web"]},{"url":"https://github.com/nodejs/node/releases/tag/v22.2.0","tags":["web"]},{"url":"https://github.com/nodejs/node/releases/tag/v22.1.0","tags":["web"]},{"url":"https://github.com/nodejs/node/releases/tag/v22.0.0","tags":["web"]},{"url":"https://github.com/yarnpkg/yarn/releases/tag/v1.22.22","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1519","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1520","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2293200","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2296417","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2296990","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2299281","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_5814.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-22018","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-22018","tags":["advisory"]},{"url":"https://hackerone.com/reports/2145862","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-22020","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-22020","tags":["advisory"]},{"url":"https://hackerone.com/reports/2092749","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-28863","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-28863","tags":["advisory"]},{"url":"https://github.com/isaacs/node-tar/security/advisories/GHSA-f5x3-32g6-xq36","tags":["article"]},{"url":"https://security.netapp.com/advisory/ntap-20240524-0005/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-36137","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_5815.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:5814","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:5815","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242543-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1227554","tags":["report"]},{"url":"https://bugzilla.suse.com/1227560","tags":["report"]},{"url":"https://bugzilla.suse.com/1227561","tags":["report"]},{"url":"https://bugzilla.suse.com/1227562","tags":["report"]},{"url":"https://bugzilla.suse.com/1227563","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-37372","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242574-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-36137","tags":["report"]},{"url":"https://nodejs.org/en/blog/vulnerability/july-2024-security-releases#fsfchownfchmod-bypasses-permission-model-cve-2024-36137---low","tags":["report"]},{"url":"https://github.com/nodejs/node/commit/93574335ffa8ef9efc0a47a6c142ea858bce49d9","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OWCPL7VTEVIGUDVKLEV2D2ITNTWKC4AZ/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23083","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23165","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59464","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21716","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48936","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-36137","description":"A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used.\r\n\r\nNode.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a \"read-only\" file descriptor to change the owner and permissions of a file.","status":"published","published":"2024-09-07T16:00:35.999Z","modified":"2025-04-30T22:25:18.074Z","cvss":[{"version":"3.0","score":3.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna"}],"updated_at":"2026-11-02T14:34:14.649724Z"}],"euvd":[{"id":"EUVD-2024-36333","description":"A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used.\r\n\r\nNode.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a \"read-only\" file descriptor to change the owner and permissions of a file.","status":"published","published":"2024-09-07T16:00:35Z","modified":"2025-04-30T22:25:18Z","cvss":[{"version":"3.0","score":3.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T20:51:58.065214Z"}],"ghsa":[{"id":"GHSA-q793-mj5v-wh68","title":"A vulnerability has been identified in Node.js, affecting users of the experimental permission...","description":"A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used.\n\nNode.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a \"read-only\" file descriptor to change the owner and permissions of a file.","status":"published","published":"2024-09-07T18:30:23Z","modified":"2024-11-22T12:39:08Z","cvss":[{"version":"3.0","score":3.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T14:58:54.680763Z"}],"nvd":[{"id":"CVE-2024-36137","description":"A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used.\r\n\r\nNode.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a \"read-only\" file descriptor to change the owner and permissions of a file.","status":"published","published":"2024-09-07T16:15:02.41Z","modified":"2026-06-17T07:36:10.207Z","cvss":[{"version":"3.0","score":3.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"}],"updated_at":"2026-11-02T14:10:24.514378Z"}],"osv":[{"id":"ALPINE-CVE-2024-36137","description":"A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used.\r\n\r\nNode.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a \"read-only\" file descriptor to change the owner and permissions of a file.","status":"published","published":"2024-09-07T16:15:02.41Z","modified":"2026-11-02T11:17:50.096581306Z","cvss":[{"version":"3.0","score":3.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"BELL-CVE-2024-36137","status":"published","published":"2024-07-12T05:58:28.56548Z","modified":"2026-02-18T06:09:36.414663Z","cvss":[{"version":"3.0","score":3.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:28:19.923987Z"},{"id":"DEBIAN-CVE-2024-36137","description":"A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used.\r \r Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a \"read-only\" file descriptor to change the owner and permissions of a file.","status":"published","published":"2024-09-07T16:15:02.41Z","modified":"2026-11-02T12:02:34.236825265Z","cvss":[{"version":"3.0","score":3.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:45:42.835825Z"},{"id":"OESA-2025-1519","title":"nodejs security update","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment, it executes JavaScript code outside of a browser.\r\n\r\nSecurity Fix(es):\n\nA vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used.\n\nNode.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a \u0026quot;read-only\u0026quot; file descriptor to change the owner and permissions of a file.(CVE-2024-36137)","status":"published","published":"2025-05-16T11:08:36Z","modified":"2026-08-18T01:17:57.904578065Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1520","title":"nodejs security update","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment, it executes JavaScript code outside of a browser.\r\n\r\nSecurity Fix(es):\n\nA vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used.\n\nNode.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a \u0026quot;read-only\u0026quot; file descriptor to change the owner and permissions of a file.(CVE-2024-36137)","status":"published","published":"2025-05-16T11:08:37Z","modified":"2026-08-18T01:17:57.925937867Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"RHSA-2024:5814","title":"Red Hat Security Advisory: nodejs:20 security update","status":"published","published":"2024-10-22T02:23:52Z","modified":"2026-10-14T10:04:48Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RHSA-2024:5815","title":"Red Hat Security Advisory: nodejs:20 security update","status":"published","published":"2024-09-16T20:58:42Z","modified":"2026-03-18T11:36:08.436504Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RLSA-2024:5815","title":"Moderate: nodejs:20 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Bypass network import restriction via data URL (CVE-2024-22020)\n\n* nodejs: fs.lstat bypasses permission model (CVE-2024-22018)\n\n* nodejs: fs.fchown/fchmod bypasses permission model (CVE-2024-36137)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-09-17T00:55:59.307259Z","modified":"2025-10-09T05:47:31.486054Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"UBUNTU-CVE-2024-36137","description":"A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used. Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a \"read-only\" file descriptor to change the owner and permissions of a file.","status":"withdrawn","published":"2024-09-07T16:15:00Z","modified":"2025-07-16T07:47:19.978819Z","cvss":[{"version":"3.0","score":3.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T16:54:50.784131Z"},{"id":"ALSA-2024:5814","title":"Moderate: nodejs:20 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* node-tar: denial of service while parsing a tar file due to lack of folders depth validation (CVE-2024-28863)\n* nodejs: Bypass network import restriction via data URL (CVE-2024-22020)\n* nodejs: fs.lstat bypasses permission model (CVE-2024-22018)\n* nodejs: fs.fchown/fchmod bypasses permission model (CVE-2024-36137)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-08-26T00:00:00Z","modified":"2026-10-29T11:02:21.716295163Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2024:5815","title":"Moderate: nodejs:20 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Bypass network import restriction via data URL (CVE-2024-22020)\n* nodejs: fs.lstat bypasses permission model (CVE-2024-22018)\n* nodejs: fs.fchown/fchmod bypasses permission model (CVE-2024-36137)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-08-26T00:00:00Z","modified":"2026-10-29T11:31:49.752264068Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"AZL-48849","title":"CVE-2024-36137 affecting package nodejs for versions less than 24.14.1-3","description":"A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used.\r\n\r\nNode.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a \"read-only\" file descriptor to change the owner and permissions of a file.","status":"published","published":"2024-09-07T16:15:02Z","modified":"2026-08-28T17:47:02.494553602Z","updated_at":"2026-11-02T15:28:06.032783Z"},{"id":"BIT-node-2024-36137","description":"A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used.\r\n\r\nNode.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a \"read-only\" file descriptor to change the owner and permissions of a file.","status":"published","published":"2024-09-10T07:13:50.127Z","modified":"2025-04-03T14:40:37.652Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"BIT-node-min-2024-36137","description":"A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used.\r\n\r\nNode.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a \"read-only\" file descriptor to change the owner and permissions of a file.","status":"published","published":"2024-12-16T13:53:45.63Z","modified":"2025-04-03T14:40:37.652Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"CVE-2024-36137","description":"A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used.\r\n\r\nNode.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a \"read-only\" file descriptor to change the owner and permissions of a file.","status":"published","published":"2024-09-07T16:15:02Z","modified":"2026-06-24T09:14:56.360397556Z","updated_at":"2026-11-02T15:44:40.704083Z"},{"id":"MGASA-2024-0282","title":"Updated nodejs \u0026 yarnpkg packages fix security vulnerabilities","description":"Nodejs 22 is the new active LTS branch and 5 CVE are fixed.\nCVE-2024-36138 - Bypass incomplete fix of CVE-2024-27980 (High)\nCVE-2024-22020 - Bypass network import restriction via data URL (Medium)\nCVE-2024-22018 - fs.lstat bypasses permission model (Low)\nCVE-2024-36137 - fs.fchown/fchmod bypasses permission model (Low)\nCVE-2024-37372 - Permission model improperly processes UNC paths (Low)\nyarn package is updated with npm 10.8.2\n","status":"published","published":"2024-08-28T17:11:44Z","modified":"2026-04-16T04:40:55.567077754Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:14214-1","title":"corepack20-20.15.1-1.1 on GA media","description":"These are all security issues fixed in the corepack20-20.15.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-22T00:00:00Z","modified":"2026-02-04T02:56:34.982757Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2024:14435-1","title":"corepack22-22.10.0-1.1 on GA media","description":"These are all security issues fixed in the corepack22-22.10.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-10-29T00:00:00Z","modified":"2026-02-04T02:15:17.587107Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2025:15802-1","title":"corepack24-24.11.1-2.1 on GA media","description":"These are all security issues fixed in the corepack24-24.11.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-12-08T00:00:00Z","modified":"2026-03-23T04:54:11.929189Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:11110-1","title":"nodejs26-26.3.1-1.1 on GA media","description":"These are all security issues fixed in the nodejs26-26.3.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-23T00:00:00Z","modified":"2026-06-24T09:00:19.692832432Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"RLSA-2024:5814","title":"Moderate: nodejs:20 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* node-tar: denial of service while parsing a tar file due to lack of folders depth validation (CVE-2024-28863)\n\n* nodejs: Bypass network import restriction via data URL (CVE-2024-22020)\n\n* nodejs: fs.lstat bypasses permission model (CVE-2024-22018)\n\n* nodejs: fs.fchown/fchmod bypasses permission model (CVE-2024-36137)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-09-17T00:54:54.665652Z","modified":"2026-02-04T07:40:20.112683Z","updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"SUSE-SU-2024:2543-1","title":"Security update for nodejs20","description":"This update for nodejs20 fixes the following issues:\n\nUpdate to 20.15.1:\n\n- CVE-2024-36138: Fixed CVE-2024-27980 fix bypass (bsc#1227560)\n- CVE-2024-22020: Fixed a bypass of network import restriction via data URL (bsc#1227554)\n- CVE-2024-22018: Fixed fs.lstat bypasses permission model (bsc#1227562)\n- CVE-2024-36137: Fixed fs.fchown/fchmod bypasses permission model (bsc#1227561)\n- CVE-2024-37372: Fixed Permission model improperly processes UNC paths (bsc#1227563)\n\nChanges in 20.15.0:\n\n- test_runner: support test plans\n- inspector: introduce the --inspect-wait flag\n- zlib: expose zlib.crc32()\n- cli: allow running wasm in limited vmem with --disable-wasm-trap-handler\n\nChanges in 20.14.0\n\n- src,permission: throw async errors on async APIs\n- test_runner: support forced exit\n\nChanges in 20.13.1:\n\n- buffer: improve base64 and base64url performance\n- crypto: deprecate implicitly shortened GCM tags\n- events,doc: mark CustomEvent as stable\n- fs: add stacktrace to fs/promises\n- report: add --report-exclude-network option\n- src: add uv_get_available_memory to report and process\n- stream: support typed arrays\n- util: support array of formats in util.styleText\n- v8: implement v8.queryObjects() for memory leak regression testing\n- watch: mark as stable\n","status":"published","published":"2024-07-17T07:51:52Z","modified":"2026-02-04T03:44:28.883947Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:2574-1","title":"Security update for nodejs20","description":"This update for nodejs20 fixes the following issues:\n\nUpdate to 20.15.1:\n\n- CVE-2024-36138: Fixed CVE-2024-27980 fix bypass (bsc#1227560)\n- CVE-2024-22020: Fixed a bypass of network import restriction via data URL (bsc#1227554)\n- CVE-2024-22018: Fixed fs.lstat bypasses permission model (bsc#1227562)\n- CVE-2024-36137: Fixed fs.fchown/fchmod bypasses permission model (bsc#1227561)\n- CVE-2024-37372: Fixed Permission model improperly processes UNC paths (bsc#1227563)\n\nChanges in 20.15.0:\n\n- test_runner: support test plans\n- inspector: introduce the --inspect-wait flag\n- zlib: expose zlib.crc32()\n- cli: allow running wasm in limited vmem with --disable-wasm-trap-handler\n\nChanges in 20.14.0\n\n- src,permission: throw async errors on async APIs\n- test_runner: support forced exit\n\nChanges in 20.13.1:\n\n- buffer: improve base64 and base64url performance\n- crypto: deprecate implicitly shortened GCM tags\n- events,doc: mark CustomEvent as stable\n- fs: add stacktrace to fs/promises\n- report: add --report-exclude-network option\n- src: add uv_get_available_memory to report and process\n- stream: support typed arrays\n- util: support array of formats in util.styleText\n- v8: implement v8.queryObjects() for memory leak regression testing\n- watch: mark as stable\n","status":"published","published":"2024-07-22T10:35:15Z","modified":"2026-02-04T03:46:39.426759Z","updated_at":"2026-11-02T15:53:55.136363Z"}]}}