CVE-2026-21716

Node.js 14 and 15 others: Missing Authorization

CVE-2026-21716 is fixed in 46 products on 2 platforms, first by RHSA-2026:7670, released March 12, 2026. 12 other affected products have no fix yet. It is not reported as exploited. Patch Radar priority: High.

HighFixed on 2 platforms
CVSS
7.5
Important
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0014
3rd percentile

An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched. As a result, code running under `--permission` with restricted `--allow-fs-write` can still use promise-based `FileHandle` methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions. This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-write` is intentionally restricted.

Where it's fixed

ProductFixed inFixReleased
Windows apps
Node.js 25.8.2 Node.js 25.8.2 Mar 24, 2026
Node.js (LTS) 24.14.1 Node.js (LTS) 24.14.1 Mar 24, 2026
Node.js 20 20.20.2 Node.js 20 20.20.2 Mar 24, 2026
Node.js 22 22.22.2 Node.js 22 22.22.2 Mar 24, 2026
Linux
nodejs · Debian 13.5 (trixie) 20.19.2+dfsg-1+deb13u2 DEBIAN-CVE-2026-21716 Mar 30, 2026
nodejs · Debian 14 22.22.2+dfsg+~cs22.19.15-1 DEBIAN-CVE-2026-21716 Mar 30, 2026
nodejs · Fedora 43 1:22.22.2-2.fc43 FEDORA-2026-E3F870229A Apr 30, 2026
nodejs · RHEL 8 1:24.14.1-2.module+el8.10.0+24190+49a46c75 RHSA-2026:7670 Mar 12, 2026
nodejs · RHEL 9 1:24.14.1-2.module+el9.7.0+24166+51c9666b RHSA-2026:7350 Mar 12, 2026
nodejs · almalinux 8 1:24.14.1-2.module_el8.10.0+4160+4819ac42 ALSA-2026:7670 Apr 13, 2026
nodejs · almalinux 9 1:24.14.1-2.module_el9.7.0+222+ef1c61e1 ALSA-2026:7350 Apr 9, 2026
nodejs · ol 8 1:24.14.1-2.module+el8.10.0+90873+35652ecc ELSA-2026-7670 Apr 13, 2026
nodejs · ol 9 1:24.14.1-2.module+el9.7.0+90866+5a953a4c ELSA-2026-7350 Apr 10, 2026
nodejs-debuginfo · Fedora 43 1:22.22.2-2.fc43 FEDORA-2026-E3F870229A Apr 30, 2026
nodejs-devel · Fedora 43 1:22.22.2-2.fc43 FEDORA-2026-E3F870229A Apr 30, 2026
nodejs-devel · RHEL 8 1:24.14.1-2.module+el8.10.0+24190+49a46c75 RHSA-2026:7670 Mar 12, 2026
nodejs-devel · RHEL 9 1:24.14.1-2.module+el9.7.0+24166+51c9666b RHSA-2026:7350 Mar 12, 2026
nodejs-devel · almalinux 8 1:24.14.1-2.module_el8.10.0+4160+4819ac42 ALSA-2026:7670 Apr 13, 2026
nodejs-devel · almalinux 9 1:24.14.1-2.module_el9.7.0+222+ef1c61e1 ALSA-2026:7350 Apr 9, 2026
nodejs-devel · ol 8 1:24.14.1-2.module+el8.10.0+90873+35652ecc ELSA-2026-7670 Apr 13, 2026
nodejs-devel · ol 9 1:24.14.1-2.module+el9.7.0+90866+5a953a4c ELSA-2026-7350 Apr 10, 2026
nodejs-docs · Fedora 43 1:22.22.2-2.fc43 FEDORA-2026-E3F870229A Apr 30, 2026
nodejs-docs · RHEL 8 1:24.14.1-2.module+el8.10.0+24190+49a46c75 RHSA-2026:7670 Mar 12, 2026
nodejs-docs · RHEL 9 1:24.14.1-2.module+el9.7.0+24166+51c9666b RHSA-2026:7350 Mar 12, 2026
nodejs-docs · almalinux 8 1:24.14.1-2.module_el8.10.0+4160+4819ac42 ALSA-2026:7670 Apr 13, 2026
nodejs-docs · almalinux 9 1:24.14.1-2.module_el9.7.0+222+ef1c61e1 ALSA-2026:7350 Apr 9, 2026
nodejs-docs · ol 8 1:24.14.1-2.module+el8.10.0+90873+35652ecc ELSA-2026-7670 Apr 13, 2026
nodejs-docs · ol 9 1:24.14.1-2.module+el9.7.0+90866+5a953a4c ELSA-2026-7350 Apr 10, 2026
nodejs-full-i18n · Fedora 43 1:22.22.2-2.fc43 FEDORA-2026-E3F870229A Apr 30, 2026
nodejs-full-i18n · RHEL 8 1:24.14.1-2.module+el8.10.0+24190+49a46c75 RHSA-2026:7670 Mar 12, 2026
nodejs-full-i18n · RHEL 9 1:24.14.1-2.module+el9.7.0+24166+51c9666b RHSA-2026:7350 Mar 12, 2026
nodejs-full-i18n · almalinux 8 1:24.14.1-2.module_el8.10.0+4160+4819ac42 ALSA-2026:7670 Apr 13, 2026
nodejs-full-i18n · almalinux 9 1:24.14.1-2.module_el9.7.0+222+ef1c61e1 ALSA-2026:7350 Apr 9, 2026
nodejs-full-i18n · ol 8 1:24.14.1-2.module+el8.10.0+90873+35652ecc ELSA-2026-7670 Apr 13, 2026
nodejs-full-i18n · ol 9 1:24.14.1-2.module+el9.7.0+90866+5a953a4c ELSA-2026-7350 Apr 10, 2026
nodejs-libs · Fedora 43 1:22.22.2-2.fc43 FEDORA-2026-E3F870229A Apr 30, 2026
nodejs-libs · RHEL 8 1:24.14.1-2.module+el8.10.0+24190+49a46c75 RHSA-2026:7670 Mar 12, 2026
nodejs-libs · RHEL 9 1:24.14.1-2.module+el9.7.0+24166+51c9666b RHSA-2026:7350 Mar 12, 2026
nodejs-libs · almalinux 8 1:24.14.1-2.module_el8.10.0+4160+4819ac42 ALSA-2026:7670 Apr 13, 2026
nodejs-libs · almalinux 9 1:24.14.1-2.module_el9.7.0+222+ef1c61e1 ALSA-2026:7350 Apr 9, 2026
nodejs-libs · ol 8 1:24.14.1-2.module+el8.10.0+90873+35652ecc ELSA-2026-7670 Apr 13, 2026
nodejs-libs · ol 9 1:24.14.1-2.module+el9.7.0+90866+5a953a4c ELSA-2026-7350 Apr 10, 2026
nodejs-libs-debuginfo · Fedora 43 1:22.22.2-2.fc43 FEDORA-2026-E3F870229A Apr 30, 2026
nodejs-nodemon · RHEL 8 0:3.0.3-1.module+el8.10.0+24190+49a46c75 RHSA-2026:7670 Mar 12, 2026
nodejs-nodemon · RHEL 9 0:3.0.3-3.module+el9.7.0+24166+51c9666b RHSA-2026:7350 Mar 12, 2026
nodejs-nodemon · almalinux 8 3.0.3-1.module_el8.10.0+4061+f8ceeab9 ALSA-2026:7670 Apr 13, 2026
nodejs-nodemon · almalinux 9 3.0.3-3.module_el9.7.0+209+ecf6523e ALSA-2026:7350 Apr 9, 2026
nodejs-nodemon · ol 8 0:3.0.3-1.module+el8.10.0+90873+35652ecc ELSA-2026-7670 Apr 13, 2026
nodejs-nodemon · ol 9 0:3.0.3-3.module+el9.7.0+90866+5a953a4c ELSA-2026-7350 Apr 10, 2026
nodejs-nodemon · rocky 8 0:3.0.3-1.module+el8.10.0+2084+ab509703 RLSA-2026:7670 Apr 13, 2026
nodejs-nodemon · rocky 9 0:3.0.3-3.module+el9.7.0+40025+0e0cf6b2 RLSA-2026:7350 Apr 10, 2026
nodejs-npm · Fedora 43 1:10.9.7-1.22.22.2.2.fc43 FEDORA-2026-E3F870229A Apr 30, 2026
nodejs-packaging · RHEL 8 0:2021.06-6.module+el8.10.0+24190+49a46c75 RHSA-2026:7670 Mar 12, 2026
nodejs-packaging · RHEL 9 0:2021.06-6.module+el9.7.0+24166+51c9666b RHSA-2026:7350 Mar 12, 2026
nodejs-packaging · almalinux 8 2021.06-6.module_el8.10.0+4086+70facd4a ALSA-2026:7670 Apr 13, 2026
nodejs-packaging · almalinux 9 2021.06-6.module_el9.7.0+209+ecf6523e ALSA-2026:7350 Apr 9, 2026
nodejs-packaging · ol 8 0:2021.06-6.module+el8.10.0+90873+35652ecc ELSA-2026-7670 Apr 13, 2026
nodejs-packaging · ol 9 0:2021.06-6.module+el9.7.0+90866+5a953a4c ELSA-2026-7350 Apr 10, 2026
nodejs-packaging · rocky 8 0:2021.06-6.module+el8.10.0+40048+6d99f608 RLSA-2026:7670 Apr 13, 2026
nodejs-packaging · rocky 9 0:2021.06-6.module+el9.7.0+40052+e32ea525 RLSA-2026:7350 Apr 10, 2026
nodejs-packaging-bundler · RHEL 8 0:2021.06-6.module+el8.10.0+24190+49a46c75 RHSA-2026:7670 Mar 12, 2026
nodejs-packaging-bundler · RHEL 9 0:2021.06-6.module+el9.7.0+24166+51c9666b RHSA-2026:7350 Mar 12, 2026
nodejs-packaging-bundler · almalinux 8 2021.06-6.module_el8.10.0+4086+70facd4a ALSA-2026:7670 Apr 13, 2026
nodejs-packaging-bundler · almalinux 9 2021.06-6.module_el9.7.0+198+8bf605ba ALSA-2026:7350 Apr 9, 2026
nodejs-packaging-bundler · ol 8 0:2021.06-6.module+el8.10.0+90873+35652ecc ELSA-2026-7670 Apr 13, 2026
nodejs-packaging-bundler · ol 9 0:2021.06-6.module+el9.7.0+90866+5a953a4c ELSA-2026-7350 Apr 10, 2026
nodejs20 · Fedora 43 1:20.20.2-3.fc43 FEDORA-2026-9DC3A61AD8 Apr 22, 2026
nodejs20 · amzn 2023 1:20.20.2-1.amzn2023.0.1 ALAS2023-2026-1577 Apr 13, 2026
nodejs20 · sles 15.6 20.20.2-150600.3.18.1 SUSE-SU-2026:1363-1 Apr 15, 2026
nodejs20-debuginfo · Fedora 43 1:20.20.2-3.fc43 FEDORA-2026-9DC3A61AD8 Apr 22, 2026
nodejs20-debuginfo · amzn 2023 1:20.20.2-1.amzn2023.0.1 ALAS2023-2026-1577 Apr 13, 2026
nodejs20-debugsource · Fedora 43 1:20.20.2-3.fc43 FEDORA-2026-9DC3A61AD8 Apr 22, 2026
nodejs20-debugsource · amzn 2023 1:20.20.2-1.amzn2023.0.1 ALAS2023-2026-1577 Apr 13, 2026
nodejs20-devel · Fedora 43 1:20.20.2-3.fc43 FEDORA-2026-9DC3A61AD8 Apr 22, 2026
nodejs20-devel · amzn 2023 1:20.20.2-1.amzn2023.0.1 ALAS2023-2026-1577 Apr 13, 2026
nodejs20-docs · Fedora 43 1:20.20.2-3.fc43 FEDORA-2026-9DC3A61AD8 Apr 22, 2026
nodejs20-docs · amzn 2023 1:20.20.2-1.amzn2023.0.1 ALAS2023-2026-1577 Apr 13, 2026
nodejs20-full-i18n · Fedora 43 1:20.20.2-3.fc43 FEDORA-2026-9DC3A61AD8 Apr 22, 2026
nodejs20-full-i18n · amzn 2023 1:20.20.2-1.amzn2023.0.1 ALAS2023-2026-1577 Apr 13, 2026
nodejs20-libs · Fedora 43 1:20.20.2-3.fc43 FEDORA-2026-9DC3A61AD8 Apr 22, 2026
nodejs20-libs · amzn 2023 1:20.20.2-1.amzn2023.0.1 ALAS2023-2026-1577 Apr 13, 2026
nodejs20-libs-debuginfo · Fedora 43 1:20.20.2-3.fc43 FEDORA-2026-9DC3A61AD8 Apr 22, 2026
nodejs20-libs-debuginfo · amzn 2023 1:20.20.2-1.amzn2023.0.1 ALAS2023-2026-1577 Apr 13, 2026
nodejs20-npm · Fedora 43 1:10.8.2-1.20.20.2.3.fc43 FEDORA-2026-9DC3A61AD8 Apr 22, 2026
nodejs20-npm · amzn 2023 1:10.8.2-1.20.20.2.1.amzn2023.0.1 ALAS2023-2026-1577 Apr 13, 2026
nodejs22 · Fedora 43 1:22.22.2-2.fc43 FEDORA-2026-E3F870229A Apr 30, 2026
nodejs22 · amzn 2023 1:22.22.2-1.amzn2023.0.1 ALAS2023-2026-1576 Apr 13, 2026
nodejs22 · opensuse-leap 16.0 22.23.0-160000.1.1 OPENSUSE-SU-2026:21058-1 Jun 25, 2026
nodejs22 · sles 15.6 22.22.2-150600.13.15.1 SUSE-SU-2026:1509-1 Apr 21, 2026
nodejs22 · sles 15.7 22.22.2-150700.3.9.1 SUSE-SU-2026:1478-1 Apr 20, 2026
nodejs22 · sles 16.0 22.23.0-160000.1.1 SUSE-SU-2026:22368-1 Jun 25, 2026
nodejs22-debuginfo · Fedora 43 1:22.22.2-2.fc43 FEDORA-2026-E3F870229A Apr 30, 2026
nodejs22-debuginfo · amzn 2023 1:22.22.2-1.amzn2023.0.1 ALAS2023-2026-1576 Apr 13, 2026
nodejs22-debugsource · Fedora 43 1:22.22.2-2.fc43 FEDORA-2026-E3F870229A Apr 30, 2026
nodejs22-debugsource · amzn 2023 1:22.22.2-1.amzn2023.0.1 ALAS2023-2026-1576 Apr 13, 2026
nodejs22-devel · amzn 2023 1:22.22.2-1.amzn2023.0.1 ALAS2023-2026-1576 Apr 13, 2026
nodejs22-docs · amzn 2023 1:22.22.2-1.amzn2023.0.1 ALAS2023-2026-1576 Apr 13, 2026
nodejs22-full-i18n · amzn 2023 1:22.22.2-1.amzn2023.0.1 ALAS2023-2026-1576 Apr 13, 2026
nodejs22-libs · amzn 2023 1:22.22.2-1.amzn2023.0.1 ALAS2023-2026-1576 Apr 13, 2026
nodejs22-libs-debuginfo · amzn 2023 1:22.22.2-1.amzn2023.0.1 ALAS2023-2026-1576 Apr 13, 2026
nodejs22-npm · amzn 2023 1:10.9.7-1.22.22.2.1.amzn2023.0.1 ALAS2023-2026-1576 Apr 13, 2026
nodejs24 · RHEL 10 24.14.1-2.el10_1 RHSA-2026:7675 Mar 12, 2026
nodejs24 · amzn 2023 1:24.14.1-1.amzn2023.0.1 ALAS2023-2026-1578 Apr 13, 2026
nodejs24 · ol 10 1:24.14.1-2.0.2.el10_1 ELSA-2026-7675 Jun 9, 2026
nodejs24 · opensuse-leap 16.0 24.14.1-160000.1.1 OPENSUSE-SU-2026:20519-1 Apr 13, 2026
nodejs24 · rocky 10 1:24.14.1-2.el10_1 RLSA-2026:7675 Apr 15, 2026
nodejs24 · sles 15.7 24.14.1-150700.15.8.1 SUSE-SU-2026:1299-1 Apr 13, 2026
nodejs24 · sles 16.0 24.14.1-160000.1.1 SUSE-SU-2026:21181-1 Apr 13, 2026
nodejs24-debuginfo · amzn 2023 1:24.14.1-1.amzn2023.0.1 ALAS2023-2026-1578 Apr 13, 2026
nodejs24-debugsource · amzn 2023 1:24.14.1-1.amzn2023.0.1 ALAS2023-2026-1578 Apr 13, 2026
nodejs24-devel · amzn 2023 1:24.14.1-1.amzn2023.0.1 ALAS2023-2026-1578 Apr 13, 2026
nodejs24-devel · ol 10 1:24.14.1-2.0.2.el10_1 ELSA-2026-7675 Jun 9, 2026
nodejs24-docs · almalinux 10 1:24.14.1-2.el10_1 ALSA-2026:7675 Apr 13, 2026
nodejs24-docs · amzn 2023 1:24.14.1-1.amzn2023.0.1 ALAS2023-2026-1578 Apr 13, 2026
nodejs24-docs · ol 10 1:24.14.1-2.0.2.el10_1 ELSA-2026-7675 Jun 9, 2026
nodejs24-full-i18n · amzn 2023 1:24.14.1-1.amzn2023.0.1 ALAS2023-2026-1578 Apr 13, 2026
nodejs24-full-i18n · ol 10 1:24.14.1-2.0.2.el10_1 ELSA-2026-7675 Jun 9, 2026
nodejs24-libs · amzn 2023 1:24.14.1-1.amzn2023.0.1 ALAS2023-2026-1578 Apr 13, 2026
nodejs24-libs · ol 10 1:24.14.1-2.0.2.el10_1 ELSA-2026-7675 Jun 9, 2026
nodejs24-libs-debuginfo · amzn 2023 1:24.14.1-1.amzn2023.0.1 ALAS2023-2026-1578 Apr 13, 2026
nodejs24-npm · almalinux 10 1:11.11.0-1.24.14.1.2.el10_1 ALSA-2026:7675 Apr 13, 2026
nodejs24-npm · amzn 2023 1:11.11.0-1.24.14.1.1.amzn2023.0.1 ALAS2023-2026-1578 Apr 13, 2026
nodejs24-npm · ol 10 1:11.11.0-1.24.14.1.2.0.2.el10_1 ELSA-2026-7675 Jun 9, 2026
npm · RHEL 8 1:11.11.0-1.24.14.1.2.module+el8.10.0+24190+49a46c75 RHSA-2026:7670 Mar 12, 2026
npm · RHEL 9 1:11.11.0-1.24.14.1.2.module+el9.7.0+24166+51c9666b RHSA-2026:7350 Mar 12, 2026
npm · almalinux 8 1:11.11.0-1.24.14.1.2.module_el8.10.0+4160+4819ac42 ALSA-2026:7670 Apr 13, 2026
npm · almalinux 9 1:11.11.0-1.24.14.1.2.module_el9.7.0+222+ef1c61e1 ALSA-2026:7350 Apr 9, 2026
npm · ol 8 1:11.11.0-1.24.14.1.2.module+el8.10.0+90873+35652ecc ELSA-2026-7670 Apr 13, 2026
npm · ol 9 1:11.11.0-1.24.14.1.2.module+el9.7.0+90866+5a953a4c ELSA-2026-7350 Apr 10, 2026
v8-11.3-devel · Fedora 43 3:11.3.244.8-1.20.20.2.3.fc43 FEDORA-2026-9DC3A61AD8 Apr 22, 2026
v8-11.3-devel · amzn 2023 3:11.3.244.8-1.20.20.2.1.amzn2023.0.1 ALAS2023-2026-1577 Apr 13, 2026
v8-12.4-devel · Fedora 43 3:12.4.254.21-1.22.22.2.2.fc43 FEDORA-2026-E3F870229A Apr 30, 2026
v8-12.4-devel · amzn 2023 3:12.4.254.21-1.22.22.2.1.amzn2023.0.1 ALAS2023-2026-1576 Apr 13, 2026
v8-13.6-devel · RHEL 8 3:13.6.233.17-1.24.14.1.2.module+el8.10.0+24190+49a46c75 RHSA-2026:7670 Mar 12, 2026
v8-13.6-devel · RHEL 9 3:13.6.233.17-1.24.14.1.2.module+el9.7.0+24166+51c9666b RHSA-2026:7350 Mar 12, 2026
v8-13.6-devel · almalinux 8 3:13.6.233.17-1.24.14.1.2.module_el8.10.0+4160+4819ac42 ALSA-2026:7670 Apr 13, 2026
v8-13.6-devel · almalinux 9 3:13.6.233.17-1.24.14.1.2.module_el9.7.0+222+ef1c61e1 ALSA-2026:7350 Apr 9, 2026
v8-13.6-devel · amzn 2023 3:13.6.233.17-1.24.14.1.1.amzn2023.0.1 ALAS2023-2026-1578 Apr 13, 2026
v8-13.6-devel · ol 8 3:13.6.233.17-1.24.14.1.2.module+el8.10.0+90873+35652ecc ELSA-2026-7670 Apr 13, 2026
v8-13.6-devel · ol 9 3:13.6.233.17-1.24.14.1.2.module+el9.7.0+90866+5a953a4c ELSA-2026-7350 Apr 10, 2026
No fix yet
Node.js 10 (Windows apps) No fix yet no-fix n/a
Node.js 12 (Windows apps) No fix yet no-fix n/a
Node.js 14 (Windows apps) No fix yet no-fix n/a
Node.js 15 (Windows apps) No fix yet no-fix n/a
Node.js 16 (Windows apps) No fix yet no-fix n/a
Node.js 17 (Windows apps) No fix yet no-fix n/a
Node.js 18 (Windows apps) No fix yet no-fix n/a
Node.js 19 (Windows apps) No fix yet no-fix n/a
Node.js 4 (Windows apps) No fix yet no-fix n/a
Node.js 6 (Windows apps) No fix yet no-fix n/a
Node.js 7 (Windows apps) No fix yet no-fix n/a
Node.js 8 (Windows apps) No fix yet no-fix n/a

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.