OpenJS Foundation Node.js up to 22.23.4/24.22.2/26.13.0 Recursive Mode fs.watch/fs.promises.watch permission

Summaryinfo

A vulnerability labeled as problematic has been found in OpenJS Foundation Node.js up to 22.23.4/24.22.2/26.13.0. The affected element is the function fs.watch/fs.promises.watch of the component Recursive Mode. Such manipulation leads to permission. This vulnerability is traded as CVE-2026-123829. An attack has to be approached locally. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in OpenJS Foundation Node.js up to 22.23.4/24.22.2/26.13.0. It has been rated as problematic. Affected by this issue is the function fs.watch/fs.promises.watch of the component Recursive Mode. The manipulation with an unknown input leads to a permission vulnerability. Using CWE to declare the problem leads to CWE-275. Impacted is confidentiality. CVE summarizes:

A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process is not permitted to read. On macOS and Windows, fs.watch() and fs.promises.watch() in recursive mode are backed by the native libuv watcher: FSEventWrap::Start checks kFileSystemRead only once, on the watched root, and FSEventWrap::OnEvent then forwards every filename libuv reports (relative paths at any depth) to the JavaScript callback without checking that each path is covered by the read grant. Code running under --permission with an exact read grant on a directory can therefore learn names such as sub/secret.txt even though readdir on that subdirectory is denied. The flaw exposes names and timing metadata, not file contents, and requires macOS or Windows plus files created under the watched directory by another actor. This vulnerability affects Node.js 26.x, 24.x, and 22.x.

The advisory is available at nodejs.org. This vulnerability is handled as CVE-2026-123829 since 11/06/2026. The exploitation is known to be easy. Local access is required to approach this attack. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1222 by the MITRE ATT&CK project.

Upgrading to version 22.23.5, 24.22.3 or 26.13.1 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• JavaScript Library

Vendor

• OpenJS Foundation

Name

• Node.js

Version

• 22.23.0
• 22.23.1
• 22.23.2
• 22.23.3
• 22.23.4
• 24.22.0
• 24.22.1
• 24.22.2
• 26.0
• 26.1
• 26.2
• 26.3
• 26.4
• 26.5
• 26.6
• 26.7
• 26.8
• 26.9
• 26.10
• 26.11
• 26.12
• 26.13.0

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion