A flaw in Node.js Permission Model enforcement allows trace_events.createTracing().enable() Writes Trace Logs Outside --allow-fs-write.
This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.
This vulnerability affects Node.js 22.x, 24.x, and 26.x.
Weakness
The code uses too many unconditional branches (such as “goto”).
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Node.js | Nodejs | 22.0 (including) | 22.23.1 (including) |
| Node.js | Nodejs | 24.0.0 (including) | 24.18.0 (including) |
| Node.js | Nodejs | 26.0.0 (including) | 26.5.0 (including) |
| Red Hat Hardened Images | RedHat | nodejs26-main-26.5.1-1.5.hum1 | * |
| Red Hat Hardened Images | RedHat | nodejs22-main-22.23.2-2.3.hum1 | * |
| Red Hat Hardened Images | RedHat | nodejs24-main-24.18.1-0.1.hum1 | * |