critical
CVE-2024-21896
nodejs: path traversal by monkey-patching buffer internals
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat7.9CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy's own label is CRITICAL. Rated critical by NVD, Azure Linux, Bitnami, Photon OS. Rated lower by Red Hat (high), AlmaLinux (high), Amazon (high), Oracle (high), Rocky Linux (high).
Description
The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.from() to obtain a Buffer from the result of path.resolve(). By monkey-patching Buffer internals, namely, Buffer.prototype.utf8Write, the application can modify the result of path.resolve(), which leads to a path traversal vulnerability. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| Azure Linux 3.0 | nodejs | 0:20.14.0-1.azl3 |
| bitnami::Bitnami Vulnerability Database | node, node-min | 20.12.0, 22.1.0 and 1 more |
| Photon OS 5.0 | nodejs, nodejs-devel | 20.11.1-1.ph5 |
| alma 8 | nodejs:20::nodejs, nodejs:20::nodejs-devel, nodejs:20::nodejs-docs and 5 more | 1:20.11.1-1.module_el8.9.0+3775+d8460d35 and 3 more |
| alma 9 | nodejs:20::nodejs, nodejs:20::nodejs-devel, nodejs:20::nodejs-docs and 5 more | 1:20.11.1-1.module_el9.3.0+88+29afeaa2 and 3 more |
| amazon linux 2023 | nodejs20, nodejs20-debuginfo, nodejs20-debugsource and 7 more | 1:20.11.1-1.amzn2023.0.1 and 2 more |
| Oracle Linux 8 | nodejs, nodejs-devel, nodejs-docs and 5 more | 1:20.11.1-1.module+el8.9.0+90250+089ba5e1 and 3 more |
| Oracle Linux 9 | nodejs, nodejs-devel, nodejs-docs and 5 more | 1:20.11.1-1.module+el9.3.0+90254+3f4d3ee1 and 3 more |
| rapidfort alma 9 | nodejs, nodejs-docs, nodejs-full-i18n and 2 more | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a and 2 more |
| rapidfort amazon linux 2023 | nodejs20, nodejs20-devel, nodejs20-docs and 3 more | 1:20.11.1-1.amzn2023.0.1 and 1 more |
| rapidfort Oracle Linux 9 | nodejs, nodejs-docs, nodejs-full-i18n and 2 more | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a and 2 more |
| rapidfort Red Hat 9 | nodejs, nodejs-docs, nodejs-full-i18n and 2 more | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a and 2 more |
Show all 89 entries from 18 sources
| Source | Package | Fixed in |
|---|---|---|
| Azure Linux 3.0 | nodejs | 0:20.14.0-1.azl3 |
| bitnami::Bitnami Vulnerability Database | node | 20.12.0, 22.1.0 |
| bitnami::Bitnami Vulnerability Database | node-min | 20.18.1, 22.12.0 |
| Photon OS 5.0 | nodejs | 20.11.1-1.ph5 |
| Photon OS 5.0 | nodejs-devel | 20.11.1-1.ph5 |
| alma 8 | nodejs:20::nodejs | 1:20.11.1-1.module_el8.9.0+3775+d8460d35 |
| alma 8 | nodejs:20::nodejs-devel | 1:20.11.1-1.module_el8.9.0+3775+d8460d35 |
| alma 8 | nodejs:20::nodejs-docs | 1:20.11.1-1.module_el8.9.0+3775+d8460d35 |
| alma 8 | nodejs:20::nodejs-full-i18n | 1:20.11.1-1.module_el8.9.0+3775+d8460d35 |
| alma 8 | nodejs:20::nodejs-nodemon | 3.0.1-1.module_el8.9.0+3731+490e3ce5 |
| alma 8 | nodejs:20::nodejs-packaging | 2021.06-4.module_el8.9.0+3684+11b9e959 |
| alma 8 | nodejs:20::nodejs-packaging-bundler | 2021.06-4.module_el8.9.0+3684+11b9e959 |
| alma 8 | nodejs:20::npm | 1:10.2.4-1.20.11.1.1.module_el8.9.0+3775+d8460d35 |
| alma 9 | nodejs:20::nodejs | 1:20.11.1-1.module_el9.3.0+88+29afeaa2 |
| alma 9 | nodejs:20::nodejs-devel | 1:20.11.1-1.module_el9.3.0+88+29afeaa2 |
| alma 9 | nodejs:20::nodejs-docs | 1:20.11.1-1.module_el9.3.0+88+29afeaa2 |
| alma 9 | nodejs:20::nodejs-full-i18n | 1:20.11.1-1.module_el9.3.0+88+29afeaa2 |
| alma 9 | nodejs:20::nodejs-nodemon | 3.0.1-1.module_el9.3.0+47+c33bc288 |
| alma 9 | nodejs:20::nodejs-packaging | 2021.06-4.module_el9.3.0+48+1cf146a1 |
| alma 9 | nodejs:20::nodejs-packaging-bundler | 2021.06-4.module_el9.3.0+48+1cf146a1 |
| alma 9 | nodejs:20::npm | 1:10.2.4-1.20.11.1.1.module_el9.3.0+88+29afeaa2 |
| amazon linux 2023 | nodejs20 | 1:20.11.1-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs20-debuginfo | 1:20.11.1-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs20-debugsource | 1:20.11.1-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs20-devel | 1:20.11.1-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs20-docs | 1:20.11.1-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs20-full-i18n | 1:20.11.1-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs20-libs | 1:20.11.1-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs20-libs-debuginfo | 1:20.11.1-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs20-npm | 1:10.2.4-1.20.11.1.1.amzn2023.0.1 |
| amazon linux 2023 | v8-11.3-devel | 3:11.3.244.8-1.20.11.1.1.amzn2023.0.1 |
| Oracle Linux 8 | nodejs | 1:20.11.1-1.module+el8.9.0+90250+089ba5e1 |
| Oracle Linux 8 | nodejs-devel | 1:20.11.1-1.module+el8.9.0+90250+089ba5e1 |
| Oracle Linux 8 | nodejs-docs | 1:20.11.1-1.module+el8.9.0+90250+089ba5e1 |
| Oracle Linux 8 | nodejs-full-i18n | 1:20.11.1-1.module+el8.9.0+90250+089ba5e1 |
| Oracle Linux 8 | nodejs-nodemon | 3.0.1-1.module+el8.9.0+90082+b6a613a6 |
| Oracle Linux 8 | nodejs-packaging | 2021.06-4.module+el8.9.0+90082+b6a613a6 |
| Oracle Linux 8 | nodejs-packaging-bundler | 2021.06-4.module+el8.9.0+90082+b6a613a6 |
| Oracle Linux 8 | npm | 1:10.2.4-1.20.11.1.1.module+el8.9.0+90250+089ba5e1 |
| Oracle Linux 9 | nodejs | 1:20.11.1-1.module+el9.3.0+90254+3f4d3ee1 |
| Oracle Linux 9 | nodejs-devel | 1:20.11.1-1.module+el9.3.0+90254+3f4d3ee1 |
| Oracle Linux 9 | nodejs-docs | 1:20.11.1-1.module+el9.3.0+90254+3f4d3ee1 |
| Oracle Linux 9 | nodejs-full-i18n | 1:20.11.1-1.module+el9.3.0+90254+3f4d3ee1 |
| Oracle Linux 9 | nodejs-nodemon | 3.0.1-1.module+el9.3.0+90066+12d4a8d7 |
| Oracle Linux 9 | nodejs-packaging | 2021.06-4.module+el9.3.0+90066+12d4a8d7 |
| Oracle Linux 9 | nodejs-packaging-bundler | 2021.06-4.module+el9.3.0+90066+12d4a8d7 |
| Oracle Linux 9 | npm | 1:10.2.4-1.20.11.1.1.module+el9.3.0+90254+3f4d3ee1 |
| rapidfort alma 9 | nodejs | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort alma 9 | nodejs-docs | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort alma 9 | nodejs-full-i18n | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort alma 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.3.0.z+20478+84a9f781, 3.0.1-1.module_el9.3.0+47+c33bc288 |
| rapidfort alma 9 | npm | 1:10.2.4-1.20.11.1.1.module+el9.3.0+21385+bac43d5a |
| rapidfort amazon linux 2023 | nodejs20 | 1:20.11.1-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | nodejs20-devel | 1:20.11.1-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | nodejs20-docs | 1:20.11.1-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | nodejs20-full-i18n | 1:20.11.1-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | nodejs20-libs | 1:20.11.1-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | nodejs20-npm | 1:10.2.4-1.20.11.1.1.amzn2023.0.1 |
| rapidfort Oracle Linux 9 | nodejs | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort Oracle Linux 9 | nodejs-docs | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort Oracle Linux 9 | nodejs-full-i18n | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort Oracle Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.3.0.z+20478+84a9f781 |
| rapidfort Oracle Linux 9 | npm | 1:10.2.4-1.20.11.1.1.module+el9.3.0+21385+bac43d5a |
| rapidfort Red Hat 9 | nodejs | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort Red Hat 9 | nodejs-docs | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort Red Hat 9 | nodejs-full-i18n | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort Red Hat 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.3.0.z+20478+84a9f781 |
| rapidfort Red Hat 9 | npm | 1:10.2.4-1.20.11.1.1.module+el9.3.0+21385+bac43d5a |
| rapidfort rocky 9 | nodejs | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort rocky 9 | nodejs-full-i18n | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort rocky 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32185+bd121a25 |
| rapidfort rocky 9 | npm | 1:10.2.4-1.20.11.1.1.module+el9.3.0+21385+bac43d5a |
| rapidfort ubuntu 20.04 | nodejs | 0:22.22.1+dfsg+~cs22.19.15-1ubuntu1 |
| rapidfort ubuntu 20.04 | rf-nodejs | 0:22.22.1+dfsg+~cs22.19.15-1ubuntu1 |
| rapidfort ubuntu 22.04 | nodejs | 0:22.22.1+dfsg+~cs22.19.15-1ubuntu1 |
| rapidfort ubuntu 22.04 | rf-nodejs | 0:22.22.1+dfsg+~cs22.19.15-1ubuntu1 |
| rapidfort ubuntu 24.04 | nodejs | 0:22.22.1+dfsg+~cs22.19.15-1ubuntu1 |
| rapidfort ubuntu 24.04 | rf-nodejs | 0:22.22.1+dfsg+~cs22.19.15-1ubuntu1 |
| rocky 8 | nodejs:20::nodejs | 1:20.11.1-1.module+el8.9.0+1776+addd4aec |
| rocky 8 | nodejs:20::nodejs-devel | 1:20.11.1-1.module+el8.9.0+1776+addd4aec |
| rocky 8 | nodejs:20::nodejs-docs | 1:20.11.1-1.module+el8.9.0+1776+addd4aec |
| rocky 8 | nodejs:20::nodejs-full-i18n | 1:20.11.1-1.module+el8.9.0+1776+addd4aec |
| rocky 8 | nodejs:20::nodejs-nodemon | 3.0.1-1.module+el8.8.0+1459+02651ab6 |
| rocky 8 | nodejs:20::nodejs-packaging | 2021.06-4.module+el8.7.0+1072+5b168780 |
| rocky 8 | nodejs:20::nodejs-packaging-bundler | 2021.06-4.module+el8.7.0+1072+5b168780 |
| rocky 8 | nodejs:20::npm | 1:10.2.4-1.20.11.1.1.module+el8.9.0+1776+addd4aec |
| rocky 9 | nodejs:22::nodejs-nodemon | 3.0.1-1.module+el9.6.0+32143+ae966e5b |
| rocky 9 | nodejs:22::nodejs-packaging | 2021.06-4.module+el9.6.0+32185+bd121a25 |
| rocky 9 | nodejs:22::nodejs-packaging-bundler | 2021.06-4.module+el9.6.0+32185+bd121a25 |
References
- http://www.openwall.com/lists/oss-security/2024/03/11/1
- https://access.redhat.com/errata/RHSA-2024:1688
- https://access.redhat.com/security/cve/CVE-2024-21896
- https://bugzilla.redhat.com/2264569
- https://bugzilla.redhat.com/2264574
- https://bugzilla.redhat.com/2264582
- https://bugzilla.redhat.com/2265717
- https://bugzilla.redhat.com/2265720
All 36 references
- https://bugzilla.redhat.com/2265722
- https://bugzilla.redhat.com/2265727
- https://bugzilla.redhat.com/show_bug.cgi?id=2264569
- https://bugzilla.redhat.com/show_bug.cgi?id=2264574
- https://bugzilla.redhat.com/show_bug.cgi?id=2264582
- https://bugzilla.redhat.com/show_bug.cgi?id=2265717
- https://bugzilla.redhat.com/show_bug.cgi?id=2265720
- https://bugzilla.redhat.com/show_bug.cgi?id=2265722
- https://bugzilla.redhat.com/show_bug.cgi?id=2265727
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46809
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21890
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21891
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21892
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21896
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22017
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22019
- https://errata.almalinux.org/9/ALSA-2024-1688.html
- https://errata.rockylinux.org/RLSA-2024:1688
- https://github.com/nodejs/node/releases/tag/v20.11.1
- https://github.com/nodejs/node/releases/tag/v21.6.2
- https://hackerone.com/reports/2218653
- https://linux.oracle.com/cve/CVE-2024-21896.html
- https://linux.oracle.com/errata/ELSA-2024-1688.html
- https://nodejs.org/en/blog/vulnerability/february-2024-security-releases#path-traversal-by-monkey-patching-buffer-internals-cve-2024-21896---high
- https://nvd.nist.gov/vuln/detail/CVE-2024-21896
- https://security.netapp.com/advisory/ntap-20240329-0002/
- https://www.cve.org/CVERecord?id=CVE-2024-21896