Node.js up to 20.20.1/22.22.1/24.14.0/25.8.1 Promises API FileHandle.chmod/FileHandle.chown file descriptor consumption

Summaryinfo

A vulnerability marked as problematic has been reported in Node.js up to 20.20.1/22.22.1/24.14.0/25.8.1. This issue affects the function FileHandle.chmod/FileHandle.chown of the component Promises API. The manipulation leads to file descriptor consumption. This vulnerability is documented as CVE-2026-21716. The attack needs to be performed locally. There is not any exploit available. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability was found in Node.js up to 20.20.1/22.22.1/24.14.0/25.8.1 and classified as problematic. This issue affects the function FileHandle.chmod/FileHandle.chown of the component Promises API. The manipulation with an unknown input leads to a file descriptor consumption vulnerability. Using CWE to declare the problem leads to CWE-769. This entry has been deprecated because it was a duplicate of CWE-774. All content has been transferred to CWE-774. Impacted is integrity. The summary by CVE is:

An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched. As a result, code running under `--permission` with restricted `--allow-fs-write` can still use promise-based `FileHandle` methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions. This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-write` is intentionally restricted.

The advisory is shared at nodejs.org. The identification of this vulnerability is CVE-2026-21716 since 01/04/2026. The exploitation is known to be easy. An attack has to be approached locally. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 304242 (Debian dsa-6183 : libnode-dev - security update), which helps to determine the existence of the flaw in a target environment.

Applying a patch is able to eliminate this problem.

The vulnerability is also documented in the databases at Tenable (304242) and EUVD (EUVD-2026-17180). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• JavaScript Library

Name

• Node.js

Version

• 20.20.0
• 20.20.1
• 22.22.0
• 22.22.1
• 24.0
• 24.1
• 24.2
• 24.3
• 24.4
• 24.5
• 24.6
• 24.7
• 24.8
• 24.9
• 24.10
• 24.11
• 24.12
• 24.13
• 24.14.0
• 25.8.0
• 25.8.1

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion