high 7.9

CVE-2024-21896 json

The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user.

published 2024-02-20 2 y ago modified 2026-09-08 2 mo ago also BIT-node-2024-21896 , BIT-node-min-2024-21896 , EUVD-2024-19507

cvss: 7.9; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.3%; EPSS 1.3% chance of exploitation in 30 days, percentile 69%
public exploits: 0; none known

The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.from() to obtain a Buffer from the result of path.resolve(). By monkey-patching Buffer internals, namely, Buffer.prototype.utf8Write, the application can modify the result of path.resolve(), which leads to a path traversal vulnerability. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Patch / fix

fixed in 4 distros 6 links 2

bitnami node 20.12.0, 22.1.0
bitnami node-min 20.18.1, 22.12.0
NodeJS Node 20.11.1, 21.6.2
nodejs nodejs 20.11.0

red hat suse opensuse almalinux rocky linux azure linux

npm RHEL 8 1:10.2.4-1.20.11.1.1.module+el8.9.0+21380+12032667
nodejs RHEL 8 1:20.11.1-1.module+el8.9.0+21380+12032667
nodejs-nodemon RHEL 8 3.0.1-1.module+el8.9.0+20473+c4e3d824
nodejs-full-i18n RHEL 8 1:20.11.1-1.module+el8.9.0+21380+12032667
nodejs-packaging RHEL 8 2021.06-4.module+el8.9.0+19519+e25b965a
nodejs-packaging-bundler RHEL 8 2021.06-4.module+el8.9.0+19519+e25b965a
npm RHEL 9 1:10.2.4-1.20.11.1.1.module+el9.3.0+21385+bac43d5a
nodejs RHEL 9 1:20.11.1-1.module+el9.3.0+21385+bac43d5a

red hat advisories RHSA-2024:1687 RHSA-2024:1688

nodejs20 SLE Module for Web and Scripting 15 SP5, openSUSE Leap 15.5 20.11.1-150500.11.6.1

suse advisories SUSE-SU-2024:0643-1

nodejs20 openSUSE Tumbleweed 20.11.1-1.1
nodejs21 openSUSE Tumbleweed 21.6.2-1.1

opensuse advisories openSUSE-SU-2024:13697-1 openSUSE-SU-2024:13698-1

npm AlmaLinux 8 1:10.2.4-1.20.11.1.1.module_el8.9.0+3775+d8460d35
nodejs AlmaLinux 8 1:20.11.1-1.module_el8.9.0+3775+d8460d35
nodejs-nodemon AlmaLinux 8 3.0.1-1.module_el8.9.0+3731+490e3ce5
nodejs-full-i18n AlmaLinux 8 1:20.11.1-1.module_el8.9.0+3775+d8460d35
nodejs-packaging AlmaLinux 8 2021.06-4.module_el8.9.0+3684+11b9e959
nodejs-packaging-bundler AlmaLinux 8 2021.06-4.module_el8.9.0+3684+11b9e959
npm AlmaLinux 9 1:10.2.4-1.20.11.1.1.module_el9.3.0+88+29afeaa2
nodejs AlmaLinux 9 1:20.11.1-1.module_el9.3.0+88+29afeaa2

almalinux advisories ALSA-2024:1687 ALSA-2024:1688

nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.6.0+32322+a8b1fd01
nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.5.0+31770+0da7192d
nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.6.0+32045+2e5d342d
nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.6.0+32143+ae966e5b
nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.6.0+32144+1d29a396
nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.6.0+32185+bd121a25
nodejs-packaging Rocky Linux 9 2021.06-4.module+el9.5.0+31770+0da7192d
nodejs-packaging Rocky Linux 9 2021.06-4.module+el9.6.0+32045+2e5d342d

rocky linux advisories RLSA-2024:1688 RLSA-2024:1687

nodejs Azure Linux 3.0 20.14.0-1

azure linux advisories AZL-35053

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

github.com/nodejs/node/releases/tag/v20.11.1 release
github.com/nodejs/node/releases/tag/v21.6.2 release

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-21896 updated 2026-11-04 cvss 7.9

nodejs: path traversal by monkey-patching buffer internals

Red Hat Enterprise Linux AppStream (v. 8) nodejs 20.11.1-1.module+el8.9.0+21380+12032667, nodejs-nodemon 3.0.1-1.module+el8.9.0+20473+c4e3d824, npm 10.2.4-1.20.11.1.1.module+el8.9.0+21380+12032667, nodejs-full-i18n 20.11.1-1.module+el8.9.0+21380+12032667, nodejs-packaging 2021.06-4.module+el8.9.0+19519+e25b965a, nodejs-packaging-bundler 2021.06-4.module+el8.9.0+19519+e25b965a
fixed: vendor fix RHSA-2024:1687
Red Hat Enterprise Linux AppStream (v. 9) nodejs 20.11.1-1.module+el9.3.0+21385+bac43d5a, npm 10.2.4-1.20.11.1.1.module+el9.3.0+21385+bac43d5a, nodejs-nodemon 3.0.1-1.module+el9.3.0.z+20478+84a9f781, nodejs-full-i18n 20.11.1-1.module+el9.3.0+21385+bac43d5a, nodejs-packaging 2021.06-4.module+el9.3.0+19518+63aad52d, nodejs-packaging-bundler 2021.06-4.module+el9.3.0+19518+63aad52d
fixed: vendor fix RHSA-2024:1688
Red Hat Enterprise Linux 8 npm, nodejs, nodejs-libs, nodejs-nodemon, nodejs-full-i18n, nodejs-packaging, +1 more Red Hat Enterprise Linux 9 npm, nodejs, nodejs-libs, nodejs-full-i18n
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-24-319-08 updated 2024-11-12 cvss 7.9

Siemens SINEC INS

Siemens SINEC INS <V1.0_SP2_Update_3
affected: fixed in V1.0 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 2 y ago (2024-03-12)

Exploit prediction

1.26% chance of exploitation in the next 30 days, higher than 69% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.0	7.9	CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N/CR:M/IR:M/AR:M
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA	3.0	7.9	CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
OSV	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
bitnami	node	>=20.0.0, <20.12.0 >=21.0.0, <22.1.0	20.12.0 22.1.0
bitnami	node-min	>=20.0.0, <20.18.1 >=21.0.0, <22.12.0	20.18.1 22.12.0

Affected products

NodeJS Node
nodejs nodejs

Classification

Weakness

CWE-27 Path Traversal: 'dir/../../filename'

Technology feeds

Node.js rss critical rss

References

hackerone.com /reports/2218653
issue-tracking, report
security.netapp.com /advisory/ntap-20240329-0002/
third-party-advisory, advisory
openwall.com /lists/oss-security/2024/03/11/1
mailing-list, third-party-advisory, advisory
nvd.nist.gov /vuln/detail/CVE-2024-21896
web
github.com /nodejs/node/releases/tag/v20.11.1
web
github.com /nodejs/node/releases/tag/v21.6.2
web
nodejs.org /en/blog/vulnerability/february-2024-security-releases#path-traversal-by-monkey-patching-buffer-internals-cve-
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary