CVE-2024-21896

FAUCET Score

CVE-2024-21896 is a critical path traversal vulnerability affecting the experimental permission model in Node.js versions 20 and 21. It allows an attacker to bypass path resolution protections by manipulating Buffer internals, specifically Buffer.prototype.utf8Write, to achieve unauthorized access to files and directories. With a CVSS score of 9.8 (CRITICAL), this vulnerability is remotely exploitable with low attack complexity, potentially leading to complete compromise of confidentiality, integrity, and availability. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 20.0, < 20.11.1CPE match	cpe:2.3:a:nodejs:node.js::::::::
		>= 21.0, < 21.6.2CPE match	cpe:2.3:a:nodejs:node.js::::::::
		>= 20.0.0, < 20.11.1CPE matchmatch criteria	cpe:2.3:a:nodejs:node.js:::::-:::*
		>= 21.0.0, < 21.6.2CPE matchmatch criteria	cpe:2.3:a:nodejs:node.js:::::-:::*

CVSS Data

CVSS version used by this source: 3.0

7.9HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

Exploitability Score

1.5

Impact Score

5.8

CvssVersion

3.0

Exploit Intelligence

EPSS Score

1.26%

Probability of exploitation in next 30 days

EPSS Percentile

66.6%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.0126 is in the 53rd percentile among its peer group of 36,897 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (6)

microsoftpatch availablevia msrc

Product: 16990-17084Fixed in: 20.14.0-1

microsoftpatch availablevia msrc

Product: 19740-17084Fixed in: 20.14.0-1

microsoftpatch availablevia msrc

Product: azl3 nodejs 20.14.0-1 on Azure Linux 3.0Fixed in: 20.14.0-1

microsoftpatch availablevia msrc

Product: azl3 nodejs 20.10.0-2 on Azure Linux 3.0Fixed in: 20.14.0-1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: nodejs:20-8090020240228165436.a75119d5

View patch

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9Fixed in: nodejs:20-9030020240229115828.rhel9

View patch

Vendor Advisories (2)

redhatCVE-2024-21896Important

nodejs: path traversal by monkey-patching buffer internals

Feb 19, 2024

microsoft2024-Feb/CVE-2024-21896Critical

The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is to be treated as a Buffer the implementation uses Buffer.from() to obtain a Buffer from the result of path.resolve(). By monkey-patching Buffer internals namely Buffer.prototype.utf8Write the application can modify the result of path.resolve() which leads to a path traversal vulnerability. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued the permission model is an experimental feature of Node.js.

Feb 13, 2024

References

hackerone.com / reports/2218653

Issue Tracking

security.netapp.com / advisory/ntap-20240329-0002

Third Party Advisory

openwall.com / lists/oss-security/2024/03/11/1

Mailing ListThird Party Advisory