CVE-2026-21716 Security feature bypass in node

What is CVE-2026-21716?

CVE-2026-21716 is a low-severity vulnerability in Nodejs Node.js, published on 30 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched. As a result, code running under `--permission` with restricted `--allow-fs-write` can still use promise-based `FileHandle` methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions. This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-write` is intentionally restricted.

Weakness: CWE-862

Which versions are affected by CVE-2026-21716?

2 open source packages ship an affected version, including node and node-min. It affects 1 product.

Products include Nodejs Node.js.

How do I fix CVE-2026-21716?

Upgrade node to a fixed version for your release line: 20.20.2, 22.22.2, 24.14.1 or 25.8.2.

Is CVE-2026-21716 being exploited?

There is no known exploitation of CVE-2026-21716 in the wild and no public exploit code.

Other vulnerabilities in Nodejs Node.js

• CVE-2023-32002 Security feature bypass in Node Critical 9.8
• CVE-2016-6303 Integer overflow in n/a Critical 9.8
• CVE-2017-15896 Security feature bypass in Node.js Critical 9.1
• CVE-2018-7160 Server-side request forgery in Node.js High 8.8
• CVE-2018-12120 Misconfiguration in Node.js High 8.1

All Nodejs Node.js vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2026-21716, AZL-81236, AZL-81254, BELL-CVE-2026-21716, BIT-node-2026-21716, BIT-node-min-2026-21716 and 11 more.