CVE-2024-36137

Severity: low (CVSS 3.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-09-07 · updated 2026-06-17

Description

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used. Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a "read-only" file descriptor to change the owner and permissions of a file.

Affected products

Node.js: 4.x from 4.0; 5.x from 5.0; 6.x from 6.0; 7.x from 7.0; 8.x from 8.0; 9.x from 9.0 — fixed in 20.15.1, 22.4.1

How to fix

Upgrade to a fixed version: Node.js 20.15.1, 22.4.1. Check the vendor advisory for mitigations.

References

https://nodejs.org/en/blog/vulnerability/july-2024-security-releases
https://security.netapp.com/advisory/ntap-20241122-0005/

Get alerted when CVE-2024-36137 or the next vulnerability affects your stack