Описание
A flaw in Node.js Permission Model enforcement allows trace_events.createTracing().enable() Writes Trace Logs Outside --allow-fs-write.
This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.
This vulnerability affects Node.js 22.x, 24.x, and 26.x.
A flaw in the Node.js Permission Model allows trace_events.createTracing().enable() to bypass --allow-fs-write restrictions and write trace logs outside intended paths, potentially leading to unauthorized information disclosure.
Отчет
This Low impact flaw in Node.js allows a local attacker to bypass filesystem write restrictions for trace logs when using trace_events.createTracing().enable(). This limited integrity impact permits specific log files to be written outside the intended --allow-fs-write boundary.
Меры по смягчению последствий
Avoid using the trace_events.createTracing().enable() function in environments that rely on the Node.js Permission Model for file system isolation. Be aware that avoiding this function disables dynamic trace log generation, which may impact performance profiling, APM monitoring, and diagnostic workflows.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | nodejs26 | Affected | ||
| Red Hat Enterprise Linux 9 | nodejs:26/nodejs | Affected | ||
| Red Hat Hardened Images | nodejs20 | Not affected | ||
| Red Hat Hardened Images | nodejs25 | Not affected | ||
| Red Hat Enterprise Linux 10 | nodejs22 | Fixed | RHSA-2026:61376 | 31.08.2026 |
| Red Hat Enterprise Linux 10 | nodejs24 | Fixed | RHSA-2026:61377 | 31.08.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | nodejs22 | Fixed | RHSA-2026:64817 | 08.09.2026 |
| Red Hat Enterprise Linux 8 | nodejs | Fixed | RHSA-2026:62219 | 01.09.2026 |
| Red Hat Enterprise Linux 8 | nodejs | Fixed | RHSA-2026:62583 | 02.09.2026 |
| Red Hat Enterprise Linux 9 | nodejs | Fixed | RHSA-2026:61383 | 31.08.2026 |
Показывать по
Дополнительная информация
Статус:
3.3 Low
CVSS3
Связанные уязвимости
A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.
A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.
A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.
A flaw in Node.js Permission Model enforcement allows `trace_events.cr ...
A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.
3.3 Low
CVSS3