CVE-2024-21896

score

<0.1

cvss

9.8

epss

1.3%

published

2024-02-20

kev added

—

first seen

2026-10-21

Node.js 20 and 21's experimental permission model contains a path traversal caused by monkey-patching Buffer.prototype.utf8Write, letting attackers modify path.resolve() results, exploit requires monkey-patching Buffer internals.