CVE-2026-21715

score

<0.1

cvss

3.3

epss

0.2%

published

2026-03-30

kev added

—

first seen

2026-10-21

Node.js 20.x, 22.x, 24.x, and 25.x contain a broken access control vulnerability caused by missing read permission checks in fs.realpathSync.native(), letting attackers bypass filesystem read restrictions, exploit requires restricted --allow-fs-read permission model.