CVE-2024-21891

score

<0.1

cvss

8.8

epss

1.2%

published

2024-02-20

kev added

—

first seen

2026-10-21

Node.js 20 and 21, which depend on built-in utility functions for path normalization in node:fs, contain a path traversal caused by overwritable functions, letting attackers bypass filesystem permission models, exploit requires using the experimental permission model.